deardeng opened a new pull request, #69981:
URL: https://github.com/apache/doris/pull/69981
Related PR: #69732
Problem Summary:
Rpcs naming an instance by `instance_id` alone, e.g. `alter_cluster`,
`alter_instance`, `update_ak_sk`, `alter_ram_user`, `list_snapshot`,
`compact_snapshot` and `get_cluster_status` by `instance_ids`, are accepted by
meta service without any proof that the caller belongs to that instance. They
can not simply be rejected, because FE sends `alter_cluster` and
`alter_instance` with `instance_id` only, and `AlterInstanceRequest` has no
`cloud_unique_id` field.
Fix:
1. New meta service config `enable_strict_instance_auth` (default false, not
mutable). When enabled, `MetaServiceProxy::call_impl` rejects with
INVALID_ARGUMENT an rpc carrying `instance_id` without `cloud_unique_id`, and
`get_cluster_status` with `instance_ids`. `alter_instance` REFRESH, which meta
service sends to other meta services by instance_id, is still accepted. The
http api authorized by token calls the impl directly and is not affected.
2. `AlterInstanceRequest` gets `optional string cloud_unique_id = 6`.
3. FE `MetaServiceClient` fills its `cloud_unique_id` into `alter_cluster`
and `alter_instance` requests that do not carry one, as it already does for
other rpcs. The cloud_unique_id derived from cluster_id (`1:<id>:fe`) is not
filled, since anyone can build it and it is not registered before the first FE
adds itself.
This only requires `cloud_unique_id` to be present. Whether `instance_id`
belongs to the `cloud_unique_id` is checked by #69732, and the two are meant to
be used together.
Rollout: upgrade meta service, then all FE, then enable the config. It is
not meant for cluster_id mode, where FE creates and joins its instance by
instance_id.
Add meta service config `enable_strict_instance_auth` to reject rpcs that
name an instance by instance_id without a cloud_unique_id. FE now sends its
cloud_unique_id in alter_cluster and alter_instance requests.
- Test: Unit Test
- meta_service_test StrictInstanceAuthTest covers the config off and on
- FE MetaServiceClientTest covers filling, keeping a given and skipping
a derived cloud_unique_id
- Behavior changed: Yes. FE sends cloud_unique_id in alter_cluster and
alter_instance; with the new config enabled, rpcs naming an instance by
instance_id only are rejected.
- Does this need documentation: Yes, the new meta service config
### What problem does this PR solve?
Issue Number: close #xxx
Related PR: #xxx
Problem Summary:
### Release note
None
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason <!-- Add your reason? -->
- Behavior changed:
- [ ] No.
- [x] Yes. <!-- Explain the behavior change -->
- Does this need documentation?
- [x] No.
- [ ] Yes. <!-- Add document PR link here. eg:
https://github.com/apache/doris-website/pull/1214 -->
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR should
merge into -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
