nevzheng opened a new issue, #14389: URL: https://github.com/apache/gravitino/issues/14389
### What would you like to be improved? **Priority: P1** (scale in the parent epic; impact if hit, not scheduling) A cleanup row reserves a table **name** (`catalog_id`, `namespace`, `table_name`). What actually needs protecting is the **files**, which belong to the dropped table's metadata location. Every path that reaches those files without using the reserved name gets past the guard. Observed symptoms (each reproduced by a test in the parent epic): | Symptom | Effect | | ------- | ------ | | A dropped table's last `metadata.json` can be registered under a new name while the job is pending. The [register guard](https://github.com/apache/gravitino/blob/bb634defdc5663a8124be5fca1c8d9e52ac096ac/iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/dispatcher/IcebergNamespaceOperationExecutor.java#L136-L137) checks only the new name. When the job runs, it deletes the registered table's data and `metadata.json`. | Data loss on a live table. Registering the last `metadata.json` is a common way to recover a mistaken drop. | | Rename onto a name that is being purged is not checked ([renameTable](https://github.com/apache/gravitino/blob/bb634defdc5663a8124be5fca1c8d9e52ac096ac/iceberg/iceberg-rest-server/src/main/java/org/apache/gravitino/iceberg/service/dispatcher/IcebergTableOperationExecutor.java#L199-L205)). | The name guard can be bypassed. | | A `FAILED` job stops reserving the name while its files may remain (#14388). | Untracked files, and the name is reused over them. | Checked and **not** a problem: creating a new table at the dropped table's location. The job deletes by reachability from the old metadata, so the new table's files survive. ### How should we improve? Have a pending job reserve its table location as well as its name: reject register when the metadata's `location()` holds an unfinished job's metadata, and apply the name check to rename destinations. Filed for discussion and prioritization; no fix is scheduled as part of this report. Parent: the async purge audit epic. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
