You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by GitBox <gi...@apache.org> on 2021/03/15 18:51:44 UTC
[GitHub] [druid] egor-ryashin opened a new pull request #10995: S3 ingestion can assume role
egor-ryashin opened a new pull request #10995:
URL: https://github.com/apache/druid/pull/10995
<!-- Thanks for trying to help us make Apache Druid be the best it can be! Please fill out as much of the following information as is possible (where relevant, and remove it when irrelevant) to help make the intention and scope of this PR clear in order to ease review. -->
<!-- Please read the doc for contribution (https://github.com/apache/druid/blob/master/CONTRIBUTING.md) before making this PR. Also, once you open a PR, please _avoid using force pushes and rebasing_ since these make it difficult for reviewers to see what you've changed in response to their reviews. See [the 'If your pull request shows conflicts with master' section](https://github.com/apache/druid/blob/master/CONTRIBUTING.md#if-your-pull-request-shows-conflicts-with-master) for more details. -->
### Description
This feature allows S3 ingestion to use the AssumeRole capability of AWS that helps with cross-account access.
It introduces 2 additional fields in S3InputSourceConfig (those are optional).
<!-- Describe the goal of this PR, what problem are you fixing. If there is a corresponding issue (referenced above), it's not necessary to repeat the description here, however, you may choose to keep one summary sentence. -->
<!-- Describe your patch: what did you change in code? How did you fix the problem? -->
<!-- If there are several relatively logically separate changes in this PR, create a mini-section for each of them. For example: -->
#### Fixed the bug ...
#### Renamed the class ...
#### Added a forbidden-apis entry ...
<!--
In each section, please describe design decisions made, including:
- Choice of algorithms
- Behavioral aspects. What configuration values are acceptable? How are corner cases and error conditions handled, such as when there are insufficient resources?
- Class organization and design (how the logic is split between classes, inheritance, composition, design patterns)
- Method organization and design (how the logic is split between methods, parameters and return types)
- Naming (class, method, API, configuration, HTTP endpoint, names of emitted metrics)
-->
<!-- It's good to describe an alternative design (or mention an alternative name) for every design (or naming) decision point and compare the alternatives with the designs that you've implemented (or the names you've chosen) to highlight the advantages of the chosen designs and names. -->
<!-- If there was a discussion of the design of the feature implemented in this PR elsewhere (e. g. a "Proposal" issue, any other issue, or a thread in the development mailing list), link to that discussion from this PR description and explain what have changed in your final design compared to your original proposal or the consensus version in the end of the discussion. If something hasn't changed since the original discussion, you can omit a detailed discussion of those aspects of the design here, perhaps apart from brief mentioning for the sake of readability of this PR description. -->
<!-- Some of the aspects mentioned above may be omitted for simple and small changes. -->
<hr>
##### Key changed/added classes in this PR
* `MyFoo`
* `OurBar`
* `TheirBaz`
<hr>
<!-- Check the items by putting "x" in the brackets for the done things. Not all of these items apply to every PR. Remove the items which are not done or not relevant to the PR. None of the items from the checklist below are strictly necessary, but it would be very helpful if you at least self-review the PR. -->
This PR has:
- [x] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [x] added documentation for new or modified features or behaviors.
- [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [x] been tested in a test Druid cluster.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] pjain1 merged pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
pjain1 merged pull request #10995:
URL: https://github.com/apache/druid/pull/10995
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] egor-ryashin edited a comment on pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
egor-ryashin edited a comment on pull request #10995:
URL: https://github.com/apache/druid/pull/10995#issuecomment-830680346
Fixed all except coverage. The code is integration with AWS API, writing mocks for it will effectively replace about 90% of code, which is unreasonable for testing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] clintropolis commented on a change in pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
clintropolis commented on a change in pull request #10995:
URL: https://github.com/apache/druid/pull/10995#discussion_r659085283
##########
File path: extensions-core/s3-extensions/pom.xml
##########
@@ -115,8 +115,8 @@
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-sts</artifactId>
- <scope>provided</scope>
Review comment:
why this change?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] egor-ryashin commented on a change in pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
egor-ryashin commented on a change in pull request #10995:
URL: https://github.com/apache/druid/pull/10995#discussion_r659184361
##########
File path: extensions-core/s3-extensions/pom.xml
##########
@@ -115,8 +115,8 @@
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-sts</artifactId>
- <scope>provided</scope>
Review comment:
`aws-common` doesn't contain it, surprisingly Kinesis extension contains it, when Kinesis ext. is removed then the S3 ext. fails.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] egor-ryashin commented on pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
egor-ryashin commented on pull request #10995:
URL: https://github.com/apache/druid/pull/10995#issuecomment-830680346
Fixed all except coverage. The code is integration with S3 API, writing mocks for it will effectively replace about 90% of code, which is unreasonable for testing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] nishantmonu51 commented on a change in pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
nishantmonu51 commented on a change in pull request #10995:
URL: https://github.com/apache/druid/pull/10995#discussion_r603542932
##########
File path: extensions-core/s3-extensions/src/main/java/org/apache/druid/data/input/s3/S3InputSourceConfig.java
##########
@@ -34,24 +34,44 @@
*/
public class S3InputSourceConfig
{
+ @Nullable
+ @JsonProperty
+ private String assumeRoleArn;
+ @Nullable
+ @JsonProperty
+ private String assumeRoleExternalId;
+ @JsonProperty
+ private PasswordProvider accessKeyId;
+ @JsonProperty
+ private PasswordProvider secretAccessKey;
Review comment:
accessKeyId and SecretAccessKey are also nullable, Can we add annotation these as well.
##########
File path: docs/ingestion/native-batch.md
##########
@@ -862,6 +862,47 @@ Sample specs:
...
```
+```json
+...
+ "ioConfig": {
+ "type": "index_parallel",
+ "inputSource": {
+ "type": "s3",
+ "uris": ["s3://foo/bar/file.json", "s3://bar/foo/file2.json"],
+ "properties": {
+ "accessKeyId": "KLJ78979SDFdS2",
+ "secretAccessKey": "KLS89s98sKJHKJKJH8721lljkd"
+ }
+ },
+ "inputFormat": {
+ "type": "json"
+ },
+ ...
+ },
+...
+```
+
+```json
+...
+ "ioConfig": {
+ "type": "index_parallel",
+ "inputSource": {
+ "type": "s3",
+ "uris": ["s3://foo/bar/file.json", "s3://bar/foo/file2.json"],
+ "properties": {
+ "accessKeyId": "KLJ78979SDFdS2",
+ "secretAccessKey": "KLS89s98sKJHKJKJH8721lljkd",
+ "assumeRoleArn": "arn:aws:iam::2981002874992:role/role-s3"
Review comment:
I believe above are some dummy IDs and roles and not some actual ones.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] egor-ryashin commented on a change in pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
egor-ryashin commented on a change in pull request #10995:
URL: https://github.com/apache/druid/pull/10995#discussion_r611031811
##########
File path: extensions-core/s3-extensions/src/main/java/org/apache/druid/data/input/s3/S3InputSourceConfig.java
##########
@@ -34,24 +34,44 @@
*/
public class S3InputSourceConfig
{
+ @Nullable
+ @JsonProperty
+ private String assumeRoleArn;
+ @Nullable
+ @JsonProperty
+ private String assumeRoleExternalId;
+ @JsonProperty
+ private PasswordProvider accessKeyId;
+ @JsonProperty
+ private PasswordProvider secretAccessKey;
Review comment:
Added.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] egor-ryashin commented on a change in pull request #10995: S3 ingestion can assume role
Posted by GitBox <gi...@apache.org>.
egor-ryashin commented on a change in pull request #10995:
URL: https://github.com/apache/druid/pull/10995#discussion_r607114166
##########
File path: docs/ingestion/native-batch.md
##########
@@ -862,6 +862,47 @@ Sample specs:
...
```
+```json
+...
+ "ioConfig": {
+ "type": "index_parallel",
+ "inputSource": {
+ "type": "s3",
+ "uris": ["s3://foo/bar/file.json", "s3://bar/foo/file2.json"],
+ "properties": {
+ "accessKeyId": "KLJ78979SDFdS2",
+ "secretAccessKey": "KLS89s98sKJHKJKJH8721lljkd"
+ }
+ },
+ "inputFormat": {
+ "type": "json"
+ },
+ ...
+ },
+...
+```
+
+```json
+...
+ "ioConfig": {
+ "type": "index_parallel",
+ "inputSource": {
+ "type": "s3",
+ "uris": ["s3://foo/bar/file.json", "s3://bar/foo/file2.json"],
+ "properties": {
+ "accessKeyId": "KLJ78979SDFdS2",
+ "secretAccessKey": "KLS89s98sKJHKJKJH8721lljkd",
+ "assumeRoleArn": "arn:aws:iam::2981002874992:role/role-s3"
Review comment:
Yes. All fake.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org