morningman opened a new pull request, #68902:
URL: https://github.com/apache/doris/pull/68902
### What problem does this PR solve?
Issue Number: None
Related PR: #67695
Problem Summary:
**In short.** This checks branch-4.1 #67695 against master and ports its
missing tests. #67695 made Iceberg maintenance actions (`expire_snapshots`,
`rollback_to_snapshot`, ...) load the table and commit their metadata inside
the catalog's authentication scope. Master already does that in the Iceberg
connector, but nothing pins that the commit itself runs inside the scope, and
the Kerberos regression lacks the two actions #67695 added.
**Background.** On branch-4.x an action loaded the table under the catalog's
authentication context and then read and committed metadata after that context
had ended, so on a Kerberized HDFS catalog the commit could run under the FE
process identity. #67695 captures the action's metadata operations and the
catalog's authenticator as one generation, runs table acquisition and the
commit in that scope, and retries once when the catalog is reset before the
mutation starts.
On master the actions live in `fe-connector-iceberg`:
`ConnectorExecuteAction` calls `IcebergProcedureOps.execute`, which runs the
table load, the procedure body and its commit inside one
`ConnectorContext.executeAuthenticated`. Each call takes its catalog ops and
its authenticator from the same connector instance, and the catalog generation
it starts with is leased until the call ends (`IcebergCatalogResourceTracker`),
so a table from a newer generation can never meet an older authenticator, and
the generation fence and retry of #67695 have nothing to port. The connector
raises the unchecked `DorisConnectorException`, which crosses Hadoop's `doAs`
unchanged.
**The problem, and what it cost.** Two of #67695's tests have no counterpart
on master:
| branch-4.x test | master |
|---|---|
| `ExecuteActionCommandTest.executesActionWithinCatalogAuthenticationScope`
| `IcebergProcedureOpsTest` only asserts that one auth scope is entered.
Loading the table inside `executeAuthenticated` and running the body after it
returns keeps every existing case green. |
| `test_iceberg_hadoop_catalog_kerberos`: `rollback_to_snapshot` and
`expire_snapshots` on the Kerberized HDFS catalog | The suite creates, inserts
and counts, but runs no action. |
**How this PR fixes it.**
- `IcebergProcedureOpsTest.commitsTheProcedureInsideTheAuthScope`: reads the
table's current snapshot just before `executeAuthenticated` leaves its scope
and asserts the rollback has already been committed. The test
`RecordingConnectorContext` gains a hook that runs at that point.
- `test_iceberg_hadoop_catalog_kerberos`: the two steps of #67695,
unchanged. A second insert, `rollback_to_snapshot` to the first snapshot (two
rows back to one), a third insert, and `expire_snapshots("retain_last" = "1")`
(three snapshots down to one).
`ExecuteActionCommandTest.retriesRollbackOnCatalogAuthenticationGenerationChange`
is not ported: master has no generation retry to test.
**Results.** Running the procedure body outside `executeAuthenticated`, with
the table still loaded and released through `withTable`, makes the new case
fail and leaves every other `IcebergProcedureOpsTest` case green. The External
pipeline runs `test_iceberg_hadoop_catalog_kerberos` (it passed in about 1.7 s
on a recent build), so the new steps are checked there.
Original author: @Gabriel39
### Release note
None
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [x] Regression test
- `test_iceberg_hadoop_catalog_kerberos` gains
`rollback_to_snapshot` and `expire_snapshots`. It needs the Kerberos docker
environment and was not run locally; the Groovy parses.
- [x] Unit Test
- `IcebergProcedureOpsTest.commitsTheProcedureInsideTheAuthScope`.
The fe-connector-iceberg tests (1500) pass.
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason <!-- Add your reason? -->
- Behavior changed:
- [x] No.
- [ ] Yes. <!-- Explain the behavior change -->
- Does this need documentation?
- [x] No.
- [ ] Yes. <!-- Add document PR link here. eg:
https://github.com/apache/doris-website/pull/1214 -->
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR should
merge into -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
