priyeshkaratha opened a new pull request, #10996:
URL: https://github.com/apache/ozone/pull/10996
## What changes were proposed in this pull request?
`sendDeleteKeysRequestAndClearList` has two related issues that prevent
delete-key requests from being handled correctly in production, particularly
when ACLs are enabled and when FSO trash handling is configured.
First, `sendDeleteKeysRequestAndClearList` submits the Ratis request without
executing `preExecute` under the appropriate UGI context. As a result,
`userInfo.userName` remains blank. When ACLs are enabled, `resolveBucketLink`
attempts to create a UGI from the blank user information and fails with
`UNAUTHORIZED`.
Second, `ozoneTrash` is captured during `KeyManager` construction, before
`OzoneManager.startTrashEmptier()` is invoked. Since all `OzoneManager` startup
paths call `keyManager.start()` before starting the trash emptier,
`ozoneManager.getOzoneTrash()` is `null` when the constructor runs. The field
is never updated afterward, causing the FSO `moveToTrash` path in
`handleAndClearFullList` to remain unreachable in production.
**Fix**
* Wrap `createClientRequest`, `preExecute`, and `submitRequest` inside:
`ugi.doAs(UserGroupInformation.createRemoteUser(bucketOwner))`, following
the existing `moveToTrash` pattern.
* Handle `IOException` from `ugi.doAs()` and `createClientRequest()` by
converting it to `ServiceException`, alongside the existing
`InterruptedException` handling.
* Remove the constructor-time assignment of `ozoneTrash`.
* Add `getEffectiveOzoneTrash()`, which returns the test-injected
`ozoneTrash` when present, otherwise retrieves `ozoneManager.getOzoneTrash()`
at call time after the trash emptier has started.
* Update `handleAndClearFullList` to use `getEffectiveOzoneTrash()`.
* Preserve existing test behavior through `setOzoneTrash(...)`.
This ensures the request is executed with the correct user context and that
the FSO trash `moveToTrash` path is correctly reached in production.
## What is the link to the Apache JIRA
HDDS-16158
## How was this patch tested?
Tested manually in cluster with security and acl enabled. Also verified
using integration test created using claude.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
