You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "zhaoyunjiong (via GitHub)" <gi...@apache.org> on 2026/02/04 20:59:23 UTC
[PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
zhaoyunjiong opened a new pull request, #27529:
URL: https://github.com/apache/flink/pull/27529
<!--
*Thank you very much for contributing to Apache Flink - we are happy that you want to help us improve Flink. To help the community review your contribution in the best possible way, please go through the checklist below, which will get the contribution into a shape in which it can be best reviewed.*
*Please understand that we do not do this to make contributions to Flink a hassle. In order to uphold a high standard of quality for code contributions, while at the same time managing a large number of contributions, we need contributors to prepare the contributions well, and give reviewers enough contextual information for the review. Please also understand that contributions that do not follow this guide will take longer to review and thus typically be picked up with lower priority by the community.*
## Contribution Checklist
- Make sure that the pull request corresponds to a [JIRA issue](https://issues.apache.org/jira/projects/FLINK/issues). Exceptions are made for typos in JavaDoc or documentation files, which need no JIRA issue.
- Name the pull request in the form "[FLINK-XXXX] [component] Title of the pull request", where *FLINK-XXXX* should be replaced by the actual issue number. Skip *component* if you are unsure about which is the best component.
Typo fixes that have no associated JIRA issue should be named following this pattern: `[hotfix] [docs] Fix typo in event time introduction` or `[hotfix] [javadocs] Expand JavaDoc for PuncuatedWatermarkGenerator`.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Make sure that the change passes the automated tests, i.e., `mvn clean verify` passes. You can set up Azure Pipelines CI to do that following [this guide](https://cwiki.apache.org/confluence/display/FLINK/Azure+Pipelines#AzurePipelines-Tutorial:SettingupAzurePipelinesforaforkoftheFlinkrepository).
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message (including the JIRA id)
- Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below.
**(The sections below can be removed for hotfixes of typos)**
-->
## What is the purpose of the change
This PR adds RRSA (RAM Roles for Service Accounts) support to the Flink OSS FileSystem, enabling Flink applications running in Alibaba Cloud Kubernetes (ACK) to authenticate with OSS using OIDC-based service account credentials.
## Brief change log
- Added RRSACredentialsProvider class that implements OSS CredentialsProvider interface for RRSA authentication
- Modified OSSFileSystemFactory to automatically detect RRSA environment variables and prepend RRSACredentialsProvider to the credential provider chain
## Verifying this change
This change added tests and can be verified as follows:
- Added unit tests (RRSACredentialsProviderTest) that verify:
- RRSA environment variable detection logic (all, partial, and missing variables)
- Credential provider initialization and error handling
- Behavior when RRSA environment is not available
- Extended integration tests (HadoopOSSFileSystemITCase) that verify:
- RRSA provider is automatically configured when environment variables are present
- RRSA provider is correctly prepended to the credential provider chain
- RRSA provider integrates properly with the OSS filesystem factory
- Manual verification can be done by:
- Deploying Flink to Alibaba Cloud ACK with RRSA-enabled service accounts
- Setting the required environment variables (ALIBABA_CLOUD_OIDC_PROVIDER_ARN, ALIBABA_CLOUD_ROLE_ARN, ALIBABA_CLOUD_OIDC_TOKEN_FILE)
- Running process that use flink-oss-fs-hadoop to accesses OSS, verifying authentication works without explicit access keys
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): yes (added aliyun credentials-java, aliyun tea, and junit-pioneer for tests)
- The public API, i.e., is any changed class annotated with @Public(Evolving): no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? yes
- If yes, how is the feature documented? JavaDocs (comprehensive JavaDoc added to RRSACredentialsProvider explaining the feature, required environment variables, and references to Alibaba Cloud RRSA documentation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "zhaoyunjiong (via GitHub)" <gi...@apache.org>.
zhaoyunjiong commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-3874987648
Thank you for checking.
Compile errors fixed.
The failed test org.apache.flink.runtime.rest.RestServerEndpointITCase.testShouldWaitForHandlersWhenClosing looks not related to my changes.
> Thanks for the PR @zhaoyunjiong! Would you mind checking the compile errors?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-5614288736
This PR has been closed since it has not had any activity in 120 days.
If you feel like this was a mistake, or you would like to continue working on it,
please feel free to re-open the PR and ask for a review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "zhaoyunjiong (via GitHub)" <gi...@apache.org>.
zhaoyunjiong commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-3873356837
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-4418471491
This PR is being marked as stale since it has not had any activity in the last 90 days.
If you would like to keep this PR alive, please leave a comment asking for a review.
If the PR has merge conflicts, update it with the latest from the base branch.
If you are having difficulty finding a reviewer, please reach out to the
community, contact details can be found here: https://flink.apache.org/what-is-flink/community/
If this PR is no longer valid or desired, please feel free to close it.
If no activity occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "zhaoyunjiong (via GitHub)" <gi...@apache.org>.
zhaoyunjiong commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-4425728270
Rebased onto latest master.
@mxm would you mind taking another look?
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #27529: [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem
URL: https://github.com/apache/flink/pull/27529
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-3849727206
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "6f80d6638a2bda6f0652b721768dfe8adcd2aa17",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "6f80d6638a2bda6f0652b721768dfe8adcd2aa17",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 6f80d6638a2bda6f0652b721768dfe8adcd2aa17 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-38987] Add RRSA (RAM Roles for Service Accounts) support for Flink OSS FileSystem [flink]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27529:
URL: https://github.com/apache/flink/pull/27529#issuecomment-5249829260
This PR is being marked as stale since it has not had any activity in the last 90 days.
If you would like to keep this PR alive, please leave a comment asking for a review.
If the PR has merge conflicts, update it with the latest from the base branch.
If you are having difficulty finding a reviewer, please reach out to the
community, contact details can be found here: https://flink.apache.org/what-is-flink/community/
If this PR is no longer valid or desired, please feel free to close it.
If no activity occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org