roryqi commented on PR #12366: URL: https://github.com/apache/gravitino/pull/12366#issuecomment-5239980373
@lasdf1234 I want to call out one concern about defining rollback semantics here. For operations that involve external systems, rollback is not equivalent to a local transaction. If the create path has already touched an external catalog or an external table location, a rollback/drop cleanup may delete externally owned directories or partially created resources. In Gravitino we generally avoid destructive rollback for external dependencies unless the resource ownership is explicit and the cleanup is known to be safe. My suggestion is to keep the contract conservative: - perform validation before external side effects whenever possible; - do not promise generic rollback after external side effects; - only allow best-effort cleanup for resources that Gravitino definitely created and owns; - document any remaining partial-failure behavior explicitly. So I prefer to revert the rollback-oriented change and keep this as an explicit design point unless we agree on a safe ownership model. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
