jojochuang commented on code in PR #11954: URL: https://github.com/apache/ozone/pull/11954#discussion_r4487781266
########## hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/server/SCMDBCheckpointServlet.java: ########## @@ -37,29 +44,49 @@ * `ozone.administrator`, e.g. `scm/[email protected]` * If Kerberos is not enabled, simply append the login user name to * `ozone.administrator`, e.g. `scm` + * + * Recon (`ozone.recon.kerberos.principal`) is also allowed, to download the SCM DB. */ public class SCMDBCheckpointServlet extends DBCheckpointServlet { private static final Logger LOG = LoggerFactory.getLogger(SCMDBCheckpointServlet.class); private static final long serialVersionUID = 1L; + private transient StorageContainerManager scm; @Override public void init() throws ServletException { - StorageContainerManager scm = (StorageContainerManager) getServletContext() + scm = (StorageContainerManager) getServletContext() .getAttribute(OzoneConsts.SCM_CONTEXT_ATTRIBUTE); if (scm == null) { LOG.error("Unable to initialize SCMDBCheckpointServlet. SCM is null"); return; } + // Only SCM admins and Recon are allowed + Collection<String> allowedUsers = new LinkedHashSet<>(scm.getScmAdminUsernames()); + String reconPrincipal = scm.getConfiguration().getObject(ReconConfig.class).getKerberosPrincipal(); + if (!reconPrincipal.isEmpty()) { + allowedUsers.add(UserGroupInformation.createRemoteUser(reconPrincipal).getShortUserName()); + } + initialize(scm.getScmMetadataStore().getStore(), scm.getMetrics().getDBCheckpointMetrics(), scm.isAdminAuthorizationEnabled(), - scm.getScmAdminUsernames(), + allowedUsers, scm.getScmAdminGroups(), "kerberos".equals(scm.getConfiguration().get(HDDS_SCM_HTTP_AUTH_TYPE, "simple"))); } + + /** + * Like the inter-SCM gRPC download, flushes the SCM transaction buffer and looks up the store per request, + * because installing a checkpoint replaces it. + */ + @Override + public DBCheckpoint getCheckpoint(Path ignoredTmpdir, boolean flush) throws IOException { + scm.getScmHAManager().asSCMHADBTransactionBuffer().flush(); Review Comment: this line could suffer from the same inconsistency flush bug in https://issues.apache.org/jira/browse/HDDS-16452 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
