shangxinli opened a new pull request, #20009: URL: https://github.com/apache/hudi/pull/20009
### Describe the issue this Pull Request addresses There is currently no way to stop a Hudi table from being upgraded past a known-good table version. During a staged 0.14 -> 1.x rollout an accidental auto-upgrade can silently make a table unreadable by older readers, or block a rollback, and the drift is usually only discovered later when a reader fails. ### Summary and Changelog Adds an opt-in ceiling on `hoodie.table.version`. Loading or writing a table whose version exceeds the pin throws `HoodieTableVersionPinExceededException` and increments a per-table counter; a version at or below the pin is unaffected. The default `UN_PINNED` disables the check, so there is no behavior change unless an operator sets it. - New config `hoodie.table.version.pinned` on `HoodieTableConfig`, default `UN_PINNED`. It can be set per table in `hoodie.properties` (e.g. via `table update-configs`), or as a JVM system property of the same key to apply a pin fleet-wide without editing every table. The table value wins; a blank table-level value falls through to the system property rather than shadowing it. - Enforced from one helper invoked at three points: `HoodieTableConfig.getTableVersion` (reads), `HoodieTableConfig.setTableVersion` (the backstop for every writer, including `TableBuilder`), and `UpgradeDowngrade.run`, which validates the target version up front so it fails before any rollback or compaction work. - New `HoodieTableVersionPinExceededException`. It is rethrown unwrapped from the nested metadata-table upgrade, since a pin violation is a configuration decision rather than a metadata table failure. - The counter is emitted through `org.apache.hudi.common.metrics.Registry`, so any configured `MetricsReporter` picks it up. Emission failures are swallowed and can never mask the exception. ### Impact None by default. `UN_PINNED` leaves every existing read and write path unchanged. When a pin is set, reads and writes above it fail fast by design. ### Risk Level low Behavior is gated behind a config that defaults to disabled. Verified with 19 new tests covering ceiling semantics, the disabled paths, system-property precedence, malformed/negative/unrecognized/blank values, pinning an existing table and re-loading it, and metric emission. The full `hudi-common` and `hudi-hadoop-common` suites pass unchanged. ### Documentation Update The new config carries a full `withDocumentation` description and is picked up by the generated config docs. No other website change is needed. ### Contributor's checklist - [x] Read through [contributor's guide](https://hudi.apache.org/contribute/how-to-contribute) - [x] Enough context is provided in the sections above - [x] Adequate tests were added if applicable -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
