Skip to content

Commit 1af6647

Browse files
davidyuan1223pan3793
davidyuan1223
authored and
pan3793
committed
[KYUUBI #7068] Iceberg ranger support check branch and tag ddl
### Why are the changes needed? Iceberg ranger check support branch and tag ddl ### How was this patch tested? - [x] create branch - [x] replace branch - [x] drop branch - [x] create tag - [x] replace tag - [x] drop tag issue #7068 ### Was this patch authored or co-authored using generative AI tooling? Closes #7069 from davidyuan1223/iceberg_branch_check. Closes #7068 d060a24 [davidyuan] update 1e05018 [davidyuan] Merge branch 'master' into iceberg_branch_check be26846 [davidyuan] update 231ed33 [davidyuan] sort spi file 6d2a5bf [davidyuan] sort spi file bc21310 [davidyuan] update 52ca367 [davidyuan] update Authored-by: davidyuan <[email protected]> Signed-off-by: Cheng Pan <[email protected]>
1 parent 6d99b20 commit 1af6647

File tree

3 files changed

+190
-0
lines changed

3 files changed

+190
-0
lines changed

‎extensions/spark/kyuubi-spark-authz/src/main/resources/table_command_spec.json

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1841,6 +1841,38 @@
18411841
"opType" : "ALTERTABLE_PROPERTIES",
18421842
"queryDescs" : [ ],
18431843
"uriDescs" : [ ]
1844+
}, {
1845+
"classname" : "org.apache.spark.sql.catalyst.plans.logical.CreateOrReplaceBranch",
1846+
"tableDescs" : [ {
1847+
"fieldName" : "table",
1848+
"fieldExtractor" : "ArrayBufferTableExtractor",
1849+
"columnDesc" : null,
1850+
"actionTypeDesc" : null,
1851+
"tableTypeDesc" : null,
1852+
"catalogDesc" : null,
1853+
"isInput" : false,
1854+
"setCurrentDatabaseIfMissing" : false,
1855+
"comment" : "Iceberg"
1856+
} ],
1857+
"opType" : "ALTERTABLE_PROPERTIES",
1858+
"queryDescs" : [ ],
1859+
"uriDescs" : [ ]
1860+
}, {
1861+
"classname" : "org.apache.spark.sql.catalyst.plans.logical.CreateOrReplaceTag",
1862+
"tableDescs" : [ {
1863+
"fieldName" : "table",
1864+
"fieldExtractor" : "ArrayBufferTableExtractor",
1865+
"columnDesc" : null,
1866+
"actionTypeDesc" : null,
1867+
"tableTypeDesc" : null,
1868+
"catalogDesc" : null,
1869+
"isInput" : false,
1870+
"setCurrentDatabaseIfMissing" : false,
1871+
"comment" : "Iceberg"
1872+
} ],
1873+
"opType" : "ALTERTABLE_PROPERTIES",
1874+
"queryDescs" : [ ],
1875+
"uriDescs" : [ ]
18441876
}, {
18451877
"classname" : "org.apache.spark.sql.catalyst.plans.logical.DeleteFromIcebergTable",
18461878
"tableDescs" : [ {
@@ -1862,6 +1894,22 @@
18621894
"opType" : "QUERY",
18631895
"queryDescs" : [ ],
18641896
"uriDescs" : [ ]
1897+
}, {
1898+
"classname" : "org.apache.spark.sql.catalyst.plans.logical.DropBranch",
1899+
"tableDescs" : [ {
1900+
"fieldName" : "table",
1901+
"fieldExtractor" : "ArrayBufferTableExtractor",
1902+
"columnDesc" : null,
1903+
"actionTypeDesc" : null,
1904+
"tableTypeDesc" : null,
1905+
"catalogDesc" : null,
1906+
"isInput" : false,
1907+
"setCurrentDatabaseIfMissing" : false,
1908+
"comment" : "Iceberg"
1909+
} ],
1910+
"opType" : "ALTERTABLE_PROPERTIES",
1911+
"queryDescs" : [ ],
1912+
"uriDescs" : [ ]
18651913
}, {
18661914
"classname" : "org.apache.spark.sql.catalyst.plans.logical.DropIdentifierFields",
18671915
"tableDescs" : [ {
@@ -1894,6 +1942,22 @@
18941942
"opType" : "ALTERTABLE_PROPERTIES",
18951943
"queryDescs" : [ ],
18961944
"uriDescs" : [ ]
1945+
}, {
1946+
"classname" : "org.apache.spark.sql.catalyst.plans.logical.DropTag",
1947+
"tableDescs" : [ {
1948+
"fieldName" : "table",
1949+
"fieldExtractor" : "ArrayBufferTableExtractor",
1950+
"columnDesc" : null,
1951+
"actionTypeDesc" : null,
1952+
"tableTypeDesc" : null,
1953+
"catalogDesc" : null,
1954+
"isInput" : false,
1955+
"setCurrentDatabaseIfMissing" : false,
1956+
"comment" : "Iceberg"
1957+
} ],
1958+
"opType" : "ALTERTABLE_PROPERTIES",
1959+
"queryDescs" : [ ],
1960+
"uriDescs" : [ ]
18971961
}, {
18981962
"classname" : "org.apache.spark.sql.catalyst.plans.logical.MergeIntoIcebergTable",
18991963
"tableDescs" : [ {

‎extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/IcebergCommands.scala

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,26 @@ object IcebergCommands extends CommandSpecs[TableCommandSpec] {
9393
AddPartitionFiled.copy(cmd)
9494
}
9595

96+
val CreateOrReplaceBranch = {
97+
val cmd = "org.apache.spark.sql.catalyst.plans.logical.CreateOrReplaceBranch"
98+
AddPartitionFiled.copy(cmd)
99+
}
100+
101+
val CreateOrReplaceTag = {
102+
val cmd = "org.apache.spark.sql.catalyst.plans.logical.CreateOrReplaceTag"
103+
AddPartitionFiled.copy(cmd)
104+
}
105+
106+
val DropBranch = {
107+
val cmd = "org.apache.spark.sql.catalyst.plans.logical.DropBranch"
108+
AddPartitionFiled.copy(cmd)
109+
}
110+
111+
val DropTag = {
112+
val cmd = "org.apache.spark.sql.catalyst.plans.logical.DropTag"
113+
AddPartitionFiled.copy(cmd)
114+
}
115+
96116
override def specs: Seq[TableCommandSpec] = Seq(
97117
CallProcedure,
98118
DeleteFromIcebergTable,
@@ -104,6 +124,10 @@ object IcebergCommands extends CommandSpecs[TableCommandSpec] {
104124
WriteDistributionAndOrdering,
105125
SetIdentifierFields,
106126
DropIdentifierFields,
127+
CreateOrReplaceBranch,
128+
CreateOrReplaceTag,
129+
DropBranch,
130+
DropTag,
107131
MergeIntoIcebergTable.copy(classname =
108132
"org.apache.spark.sql.catalyst.plans.logical.UnresolvedMergeIntoIcebergTable"))
109133
}

‎extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -484,4 +484,106 @@ class IcebergCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite
484484
doAs(admin, sql(dropIdentifierSql))
485485
}
486486
}
487+
488+
test("CREATE BRANCH for Iceberg") {
489+
val table = s"$catalogV2.$namespace1.partitioned_table"
490+
withCleanTmpResources(Seq((table, "table"))) {
491+
doAs(
492+
admin,
493+
sql(
494+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
495+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
496+
val createBranchSql = s"ALTER TABLE $table CREATE BRANCH test_branch"
497+
interceptEndsWith[AccessControlException] {
498+
doAs(someone, sql(createBranchSql))
499+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
500+
doAs(admin, sql(createBranchSql))
501+
}
502+
}
503+
504+
test("CREATE TAG for Iceberg") {
505+
val table = s"$catalogV2.$namespace1.partitioned_table"
506+
withCleanTmpResources(Seq((table, "table"))) {
507+
doAs(
508+
admin,
509+
sql(
510+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
511+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
512+
val createTagSql = s"ALTER TABLE $table CREATE TAG test_tag"
513+
interceptEndsWith[AccessControlException] {
514+
doAs(someone, sql(createTagSql))
515+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
516+
doAs(admin, sql(createTagSql))
517+
}
518+
}
519+
520+
test("REPLACE BRANCH for Iceberg") {
521+
val table = s"$catalogV2.$namespace1.partitioned_table"
522+
withCleanTmpResources(Seq((table, "table"))) {
523+
doAs(
524+
admin,
525+
sql(
526+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
527+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
528+
doAs(admin, sql(s"ALTER TABLE $table CREATE BRANCH test_branch"))
529+
doAs(admin, sql(s"INSERT INTO $table VALUES (2, 'test2', 'city2')"))
530+
val replaceBranchSql = s"ALTER TABLE $table REPLACE BRANCH test_branch"
531+
interceptEndsWith[AccessControlException] {
532+
doAs(someone, sql(replaceBranchSql))
533+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
534+
doAs(admin, sql(replaceBranchSql))
535+
}
536+
}
537+
538+
test("REPLACE TAG for Iceberg") {
539+
val table = s"$catalogV2.$namespace1.partitioned_table"
540+
withCleanTmpResources(Seq((table, "table"))) {
541+
doAs(
542+
admin,
543+
sql(
544+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
545+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
546+
doAs(admin, sql(s"ALTER TABLE $table CREATE TAG test_tag"))
547+
doAs(admin, sql(s"INSERT INTO $table VALUES (2, 'test2', 'city2')"))
548+
val replaceTagSql = s"ALTER TABLE $table REPLACE TAG test_tag"
549+
interceptEndsWith[AccessControlException] {
550+
doAs(someone, sql(replaceTagSql))
551+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
552+
doAs(admin, sql(replaceTagSql))
553+
}
554+
}
555+
556+
test("DROP BRANCH for Iceberg") {
557+
val table = s"$catalogV2.$namespace1.partitioned_table"
558+
withCleanTmpResources(Seq((table, "table"))) {
559+
doAs(
560+
admin,
561+
sql(
562+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
563+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
564+
doAs(admin, sql(s"ALTER TABLE $table CREATE BRANCH test_branch"))
565+
val dropBranchSql = s"ALTER TABLE $table DROP BRANCH test_branch"
566+
interceptEndsWith[AccessControlException] {
567+
doAs(someone, sql(dropBranchSql))
568+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
569+
doAs(admin, sql(dropBranchSql))
570+
}
571+
}
572+
573+
test("DROP TAG for Iceberg") {
574+
val table = s"$catalogV2.$namespace1.partitioned_table"
575+
withCleanTmpResources(Seq((table, "table"))) {
576+
doAs(
577+
admin,
578+
sql(
579+
s"CREATE TABLE $table (id int NOT NULL, name string, city string) USING iceberg"))
580+
doAs(admin, sql(s"INSERT INTO $table VALUES (1, 'test', 'city')"))
581+
doAs(admin, sql(s"ALTER TABLE $table CREATE TAG test_tag"))
582+
val dropTagSql = s"ALTER TABLE $table DROP TAG test_tag"
583+
interceptEndsWith[AccessControlException] {
584+
doAs(someone, sql(dropTagSql))
585+
}(s"does not have [alter] privilege on [$namespace1/partitioned_table]")
586+
doAs(admin, sql(dropTagSql))
587+
}
588+
}
487589
}

0 commit comments

Comments
 (0)