[GitHub] [nifi] bbende commented on pull request #4712: NIFI-7885 Added Environment Variable to deny LFS access using Hadoop

[GitBox <gi...@apache.org>]

bbende commented on pull request #4712:
URL: https://github.com/apache/nifi/pull/4712#issuecomment-740930522


   Code looks good, also built and tested this and seems to be working as described.
   
   With the check inside `getFileSystemAsUser`, that first gets called during `onScheduled` so the error is produced when the user starts the processor in the UI. We then get an error like:
   
   ```
   2020-12-08 19:38:21,329 ERROR org.apache.nifi.processors.hadoop.PutHDFS: PutHDFS[id=4388cbe3-0176-1000-ffff-ffffcb860909] HDFS Configuration error - java.nio.file.AccessDeniedException: file:///: LFS Access Denied according to Environment Variable [NIFI_HDFS_DENY_LOCAL_FILE_SYSTEM_ACCESS]: java.nio.file.AccessDeniedException: file:///: LFS Access Denied according to Environment Variable [NIFI_HDFS_DENY_LOCAL_FILE_SYSTEM_ACCESS]
   java.n
   
   2020-12-08 19:38:21,331 ERROR org.apache.nifi.processors.hadoop.PutHDFS: PutHDFS[id=4388cbe3-0176-1000-ffff-ffffcb860909] Failed to properly initialize Processor. If still scheduled to run, NiFi will attempt to initialize and run the Processor again after the 'Administrative Yield Duration' has elapsed. Failure is due to java.nio.file.AccessDeniedException: file:///: LFS Access Denied according to Environment Variable [NIFI_HDFS_DENY_LOCAL_FILE_SYSTEM_ACCESS]: java.nio.file.AccessDeniedException: file:///: LFS Access Denied according to Environment Variable [NIFI_HDFS_DENY_LOCAL_FILE_SYSTEM_ACCESS]
   java.nio.file.AccessDeniedException: file:///: LFS Access Denied according to Environment Variable [NIFI_HDFS_DENY_LOCAL_FILE_SYSTEM_ACCESS]
   ```
   At this point if flow files are sent into the processor they remain in the incoming queue since the processor technically isn't running yet, and the framework continues trying to call onScheduled after yielding.
   
   I'm wondering if a better user experience would be to perform the check in `customValidate` so that the processor is not valid and can't be started and avoids all of the continuous errors above. We already have the `Configuration` object available and just need to get the value of `fs.defaultFS` and then use your same matcher against that value, thoughts?
   
   https://github.com/apache/nifi/blob/main/nifi-nar-bundles/nifi-extension-utils/nifi-hadoop-utils/src/main/java/org/apache/nifi/processors/hadoop/AbstractHadoopProcessor.java#L219


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org