Github user mcgilman commented on a diff in the pull request: https://github.com/apache/nifi/pull/2990#discussion_r217121570 --- Diff: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/manager/ControllerServiceEntityMerger.java --- @@ -137,7 +138,9 @@ public static void mergeControllerServiceReferences(final Set<ControllerServiceR for (final ControllerServiceReferencingComponentEntity nodeReferencingComponentEntity : nodeReferencingComponents) { final ControllerServiceReferencingComponentDTO nodeReferencingComponent = nodeReferencingComponentEntity.getComponent(); - if (nodeReferencingComponentEntity.getPermissions().getCanRead()) { + final Boolean canRead = nodeReferencingComponentEntity.getPermissions().getCanRead(); + final Boolean canOperate = nodeReferencingComponentEntity.getOperatePermissions().getCanWrite(); + if (canRead || canOperate) { --- End diff -- If `canRead` is false here, but `canOperate` is true, I believe we'd end update with a `NPE` since the referencing component should not be populated.
---