-
Notifications
You must be signed in to change notification settings - Fork 970
[KYUUBI #7079] Improve performance of AccessRequest initialization #7081
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from 7 commits
3c085a8
f6169fc
9b23700
01175f3
bd99fcc
c8401b5
6c9e7cf
686c45b
99e0bd3
321e3a7
883d135
4b4c4bf
7847137
48d312a
743863c
ea70d92
b902a29
bb469c7
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -24,14 +24,17 @@ import scala.collection.JavaConverters._ | |||||
|
|
||||||
| import org.apache.hadoop.security.UserGroupInformation | ||||||
| import org.apache.ranger.plugin.policyengine.{RangerAccessRequestImpl, RangerPolicyEngine} | ||||||
| import org.apache.spark.internal.Logging | ||||||
|
|
||||||
| import org.apache.kyuubi.plugin.spark.authz.OperationType.OperationType | ||||||
| import org.apache.kyuubi.plugin.spark.authz.ranger.AccessType._ | ||||||
| import org.apache.kyuubi.util.reflect.DynMethods | ||||||
| import org.apache.kyuubi.util.reflect.DynMethods.UnboundMethod | ||||||
| import org.apache.kyuubi.util.reflect.ReflectUtils._ | ||||||
|
|
||||||
| case class AccessRequest private (accessType: AccessType) extends RangerAccessRequestImpl | ||||||
|
|
||||||
| object AccessRequest { | ||||||
| object AccessRequest extends Logging { | ||||||
| def apply( | ||||||
| resource: AccessResource, | ||||||
| user: UserGroupInformation, | ||||||
|
|
@@ -45,12 +48,11 @@ object AccessRequest { | |||||
| req.setUserGroups(userGroups) | ||||||
| req.setAction(opType.toString) | ||||||
| try { | ||||||
| val roles = invokeAs[JSet[String]]( | ||||||
| SparkRangerAdminPlugin, | ||||||
| "getRolesFromUserAndGroups", | ||||||
| (classOf[String], userName), | ||||||
| (classOf[JSet[String]], userGroups)) | ||||||
| invokeAs[Unit](req, "setUserRoles", (classOf[JSet[String]], roles)) | ||||||
| getRolesFromUserAndGroupsMethod.zip(setUserRolesMethod).foreach { | ||||||
| case (getMethod, setMethod) => | ||||||
| val roles = getMethod.invoke[JSet[String]](SparkRangerAdminPlugin, userName, userGroups) | ||||||
| setMethod.invoke[Unit](req, roles) | ||||||
| } | ||||||
| } catch { | ||||||
| case _: Exception => | ||||||
| } | ||||||
|
|
@@ -68,17 +70,43 @@ object AccessRequest { | |||||
| req | ||||||
| } | ||||||
|
|
||||||
| private val getRolesFromUserAndGroupsMethod: Option[UnboundMethod] = | ||||||
| getMethod( | ||||||
| SparkRangerAdminPlugin.getClass, | ||||||
| "getRolesFromUserAndGroups", | ||||||
| classOf[String], | ||||||
| classOf[JSet[String]]) | ||||||
|
|
||||||
| private val setUserRolesMethod: Option[UnboundMethod] = | ||||||
| getMethod(classOf[AccessRequest], "setUserRoles", classOf[JSet[String]]) | ||||||
|
|
||||||
| private def getUserGroupsFromUgi(user: UserGroupInformation): JSet[String] = { | ||||||
| user.getGroupNames.toSet.asJava | ||||||
| } | ||||||
|
|
||||||
| private lazy val getUserStoreEnricherMethod: Option[UnboundMethod] = | ||||||
| getMethod(SparkRangerAdminPlugin.getClass, "getUserStoreEnricher") | ||||||
wForget marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
|
|
||||||
| private lazy val getRangerUserStoreMethod: Option[UnboundMethod] = | ||||||
| getMethod( | ||||||
| Class.forName("org.apache.ranger.plugin.contextenricher.RangerUserStoreEnricher"), | ||||||
| "getRangerUserStore") | ||||||
|
|
||||||
| private lazy val getUserGroupMappingMethod: Option[UnboundMethod] = | ||||||
| getMethod( | ||||||
| Class.forName("org.apache.ranger.plugin.util.RangerUserStore"), | ||||||
|
||||||
| val userGroupMapping = | |
| invokeAs[JHashMap[String, JSet[String]]](userStore, "getUserGroupMapping") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see, it's a new feature of Ranger 2.1, we must use reflection as long as we support lower Ranger versions
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SparkRangerAdminPluginis an object and does not seem to work withclassOf.