ajayvembu commented on code in PR #15869:
URL: https://github.com/apache/iceberg/pull/15869#discussion_r3164903595
##########
azure/src/main/java/org/apache/iceberg/azure/adlsv2/ADLSFileIO.java:
##########
@@ -259,11 +281,93 @@ public void deletePrefix(String prefix) {
}
@Override
- public void close() {
- if (vendedAdlsCredentialProvider != null) {
- vendedAdlsCredentialProvider.close();
+ public void setCredentials(List<StorageCredential> credentials) {
+ Preconditions.checkArgument(credentials != null, "Invalid storage
credentials: null");
+ // stop any refresh that might be scheduled
+ if (refreshFuture != null) {
+ refreshFuture.cancel(true);
+ }
+
+ // copy credentials into a modifiable collection for Kryo serde
+ this.storageCredentials = Lists.newArrayList(credentials);
+
+ // if the clients are already initialized, we need to allow them to be
recreated
+ synchronized (this) {
+ if (clientCache != null) {
+ this.clientCache = null;
+ }
+ }
+ }
+
+ @Override
+ public List<StorageCredential> credentials() {
+ return ImmutableList.copyOf(storageCredentials);
+ }
+
+ private void scheduleCredentialRefresh() {
+ storageCredentials.stream()
+ .flatMap(cred -> cred.config().entrySet().stream())
+ .filter(e ->
e.getKey().startsWith(AzureProperties.ADLS_SAS_TOKEN_EXPIRES_AT_MS_PREFIX))
+ .map(e -> Instant.ofEpochMilli(Long.parseLong(e.getValue())))
+ .min(Comparator.naturalOrder())
+ .ifPresent(
+ expiresAt -> {
+ Instant prefetchAt = expiresAt.minus(5, ChronoUnit.MINUTES);
+ long delay = Duration.between(Instant.now(),
prefetchAt).toMillis();
+ this.refreshFuture =
+ executorService()
+ .schedule(this::refreshStorageCredentials, delay,
TimeUnit.MILLISECONDS);
+ });
+ }
+
+ private void refreshStorageCredentials() {
+ if (isResourceClosed.get() || vendedAdlsCredentialProvider == null) {
+ return;
+ }
+
+ try {
+ List<StorageCredential> refreshed =
+
vendedAdlsCredentialProvider.fetchCredentials().credentials().stream()
+ .filter(c -> c.prefix().startsWith(ROOT_PREFIX))
+ .map(c -> StorageCredential.create(c.prefix(), c.config()))
+ .collect(Collectors.toList());
+
+ if (!refreshed.isEmpty() && !isResourceClosed.get()) {
+ this.storageCredentials = Lists.newArrayList(refreshed);
+ scheduleCredentialRefresh();
Review Comment:
I noticed that after we update storageCredentials, clientCache isn't being
cleared. If its not cleared next time client invokes client() method will be
handed over the same obsolete credentials. We need to invalidate the
clientCache here.
```
synchronized (this) {
this.clientCache = null;
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
