[
https://issues.apache.org/jira/browse/HADOOP-19940?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18098553#comment-18098553
]
ASF GitHub Bot commented on HADOOP-19940:
-----------------------------------------
anujmodi2021 commented on code in PR #8607:
URL: https://github.com/apache/hadoop/pull/8607#discussion_r3640269781
##########
hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azurebfs/ITestAzureBlobFilesystemAcl.java:
##########
@@ -1529,4 +1533,281 @@ private void assertPermission(FileSystem fs, Path
pathToCheck, short perm)
throws Exception {
AclTestHelpers.assertPermission(fs, pathToCheck, perm);
}
+
+ // =========================================================================
+ // Tests for fs.azure.rbac.only mode.
+ //
+ // When fs.azure.rbac.only=true on an HNS-enabled account:
+ // - setPermission() must be a no-op (permission is not updated on the
+ // backend) so RBAC-only workloads are not blocked by lack of
+ // ACL-management permissions.
+ // - Explicit ACL management APIs (setAcl, modifyAclEntries,
+ // removeAclEntries, removeDefaultAcl, removeAcl) must be unaffected.
+ //
+ // On non-HNS accounts the flag must have no effect (existing behavior).
+ // =========================================================================
+
+ /**
+ * When RBAC-only mode is enabled on an HNS-enabled account, setPermission
+ * must be treated as a no-op: the on-storage permission stays at whatever
+ * it was before the setPermission() call.
+ */
+ @Test
+ public void testSetPermissionNoOpWhenRbacOnlyEnabledOnHns() throws Exception
{
+ final AzureBlobFileSystem fs = getRbacOnlyFileSystem(true);
+ assumeTrue(getIsNamespaceEnabled(fs));
+
+ path = new Path(testRoot, UUID.randomUUID().toString());
+ FileSystem.mkdirs(fs, path, FsPermission.createImmutable((short) RWX_RX));
+
+ // Capture the current permission before the (should-be no-op) call.
+ FsPermission before = fs.getFileStatus(path).getPermission();
+
+ // This must NOT touch the backend ACL/permission.
+ fs.setPermission(path, FsPermission.createImmutable((short) RWX));
+
+ FsPermission after = fs.getFileStatus(path).getPermission();
+ assertEquals(before, after,
+ "setPermission() must be a no-op when fs.azure.rbac.only=true "
Review Comment:
NIT: Suggestion to add an assert that store.setPermission() was not invoked.
> ABFS: Set permissions should be no-op for RBAC
> ----------------------------------------------
>
> Key: HADOOP-19940
> URL: https://issues.apache.org/jira/browse/HADOOP-19940
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: fs/azure
> Affects Versions: 3.5.0
> Reporter: Anmol Asrani
> Assignee: Anmol Asrani
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.5.1
>
>
> *Proposal from ABFS driver side: -*
> Introduce an optional ABFS configuration, for example:
> *fs.azure.rbac.only=true*
> When this configuration is enabled for {*}HNS-enabled accounts{*}, ABFS will
> check the flag in AzureBlobFileSystem#setPermission() before invoking the
> backend ACL update operation. If the account is HNS-enabled and
> fs.azure.rbac.only=true, setPermission() will be treated as a no-op and the
> driver will return success without issuing a SetAccessControl request to ADLS
> Gen2.
> This enables customers who have chosen an *RBAC-only authorization model* to
> run Spark and Hadoop workloads without requiring ACL-management permissions,
> while still retaining RBAC-based access to data operations.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
