You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "davidyuan1223 (via GitHub)" <gi...@apache.org> on 2023/11/05 08:13:21 UTC

[PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

davidyuan1223 opened a new pull request, #5592:
URL: https://github.com/apache/kyuubi/pull/5592

   <!--
   Thanks for sending a pull request!
   
   Here are some tips for you:
     1. If this is your first time, please read our contributor guidelines: https://kyuubi.readthedocs.io/en/latest/community/CONTRIBUTING.html
     2. If the PR is related to an issue in https://github.com/apache/kyuubi/issues, add '[KYUUBI #XXXX]' in your PR title, e.g., '[KYUUBI #XXXX] Your PR title ...'.
     3. If the PR is unfinished, add '[WIP]' in your PR title, e.g., '[WIP][KYUUBI #XXXX] Your PR title ...'.
   -->
   
   ### _Why are the changes needed?_
   <!--
   Please clarify why the changes are needed. For instance,
     1. If you add a feature, you can talk about the use case of it.
     2. If you fix a bug, you can clarify why it is a bug.
   -->
   This pr is try to fix the https://github.com/apache/kyuubi/pull/5590 's problem, but i get some problem, so need someone to help me. The problem desc:
   
   this is the source commt https://github.com/apache/kyuubi/pull/5590
           i try to add PaimonDataSourceV2RelationTableExtractor in TableExtractor to make we can fix the question, but when i add the extractor and get table info, this is the root call extrcator code
   ```
   case class RuleApplyRowFilter(spark: SparkSession) extends RuleHelper {
       override def apply(plan: LogicalPlan): LogicalPlan = {
           val newPlan = mapChildren(plan) {
               case p: RowFilterMarker => p
               case scan if isKnownScan(scan) && scan.resolved =>
                   val tables = getScanSpec(scan).tables(scan, spark)
                   tables.headOption.map(applyFilter(scan, _)).getOrElse(scan)
               case other => apply(other)
           }
           newPlan
       }
   
       private def applyFilter(
               plan: LogicalPlan,
               table: Table): LogicalPlan = {
           val are = AccessResource(ObjectType.TABLE, table.database.orNull, table.table, null)
           val art = AccessRequest(are, ugi, QUERY, AccessType.SELECT)
           val filterExpr = SparkRangerAdminPlugin.getFilterExpr(art).map(parse)
           val filtered = filterExpr.foldLeft(plan)((p, expr) => Filter(expr, RowFilterMarker(p)))
           filtered
       }
   }
   ```
   if we add two exector for the RelationV2 plan, we will get two tables, but the apply code only use the first table
   if the tables is
   ```
   Table(Some(paimon_catalog),None,table1,Some(admin))
   Table(Some(paimon_catalog),Some(paimon_ns),table1,Some(admin))
   ```
   the source code will only filter the first table result, is that right?
   
   
   @bowenliang123 @pan3793 do you know how to solve this?
   
   
   ### _How was this patch tested?_
   - [ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible
   
   - [ ] Add screenshots for manual tests if appropriate
   
   - [ ] [Run test](https://kyuubi.readthedocs.io/en/master/contributing/code/testing.html#running-tests) locally before make a pull request
   
   
   ### _Was this patch authored or co-authored using generative AI tooling?_
   <!--
   If a generative AI tooling has been used in the process of authoring this patch, please include
   phrase 'Generated-by: ' followed by the name of the tool and its version.
   If no, write 'No'.
   Please refer to the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) for details.
   -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1794587762

   > I agree with you. This is an impact from upstream. Authz requires proper identifier from logical plan for privilege checks.
   
   yes, maybe we need close the issue #5470 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "bowenliang123 (via GitHub)" <gi...@apache.org>.
bowenliang123 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1815838518

   cc @SteNicholas 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1793761872

   > > I have a question, how can we make the verify not one failed make all failed? or how can we merge the two result from the same implementation's tableExtractor?
   > 
   > I don't quite understand your description or question here. Extractors are targeted for extracting privilege objects which are then distinct before verified with policies in RuleAuthorization. Any violation surely failed the whole plan as all the privilege objects must be checked.
   
   because i debug in local env, i found the violation failed reason is the DataSourceV2RelationTableExtractor's targe, then it will not violation other, event though i get the paimon's right result, it also failed, how shoud i fix to make the  violation success?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "bowenliang123 (via GitHub)" <gi...@apache.org>.
bowenliang123 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1793669785

   Cool. This would important for Paimon support.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1794569396

   i think paimon should not supported in the authz module currently, i have try to fix this problem, but the root cause is paimon, i have get database from paimon's path
   ![image](https://github.com/apache/kyuubi/assets/51512358/5fec34e2-9c4a-4473-98cb-7b6f78611fd1)
   
   But the test case also failed 
   ![image](https://github.com/apache/kyuubi/assets/51512358/058c26a4-c800-4df3-a1ad-be1f0124a966)
   @bowenliang123 @pan3793 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1793710893

   ![未命名文件](https://github.com/apache/kyuubi/assets/51512358/a6b8e8ee-6305-41b0-99e0-8aa765faf00c)
   This is the verify for createTableAs's select timeline picture, currently, the problem is:
   We add a new TableExtractor for DataSourceV2Relation, when we scan the spec and call tables, it will call DataSourceV2RelationTableExtractor and PaimonDataSourceV2RelationTableExtractor, so they will return two result for tables.
   And we will use the tables for a inputObjs, then add Request by the inputObjs, when we verify for the requestArray, anyone failed, the all application is failed.
   I have a question, how can we make the verify not one failed make all failed? or how can we merge the two result from the same implementation's tableExtractor?
   I think same plan's relation have many extractor is right, but how can we get the right tableExtractor's result which is we want?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "bowenliang123 (via GitHub)" <gi...@apache.org>.
bowenliang123 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1793759001

   > I have a question, how can we make the verify not one failed make all failed? or how can we merge the two result from the same implementation's tableExtractor?
   
   I don't quite understand your description or question here.
   Extractors are targeted for extracting privilege objects which are then distinct before verified with policies in RuleAuthorization. Any violation surely failed the whole plan as all the privilege objects must be checked.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1793670210

   > Cool. This would important for Paimon support.
   
   yes, i try to fix this, but the comment's code looks like is conflict with our update? The file scan_command_spec support list extractor
   ```
   val tables = getScanSpec(scan).tables(scan, spark)
                   tables.headOption.map(applyFilter(scan, _)).getOrElse(scan)
   ```
   but the code only filter the first extractor's result


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "bowenliang123 (via GitHub)" <gi...@apache.org>.
bowenliang123 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-1794578439

   I agree with you. This is an impact from upstream. Authz requires proper identifier from logical  plan for privilege checks.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 closed pull request #5592: [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem 
URL: https://github.com/apache/kyuubi/pull/5592


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 commented on PR #5592:
URL: https://github.com/apache/kyuubi/pull/5592#issuecomment-2659025508

   hello, i found kyuubi recently use identifier to resolve paimon's auth range problem, i think we could open that issue to test it?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] test [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 closed pull request #5592: test
URL: https://github.com/apache/kyuubi/pull/5592


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org


Re: [PR] [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem [kyuubi]

Posted by "davidyuan1223 (via GitHub)" <gi...@apache.org>.
davidyuan1223 closed pull request #5592: [AUTHZ] Add PaimonDataSourceV2RelationTableExtractor to fix paimon select cannot get database's problem 
URL: https://github.com/apache/kyuubi/pull/5592


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org