alexandrefimov opened a new issue, #7671: URL: https://github.com/apache/kyuubi/issues/7671
### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) ### Search before asking - [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues. ### Describe the feature `AuthzConfigurationChecker` rejects a `spark.sql.optimizer.excludedRules` value that names `org.apache.kyuubi.plugin.spark.authz.ranger`, which was the whole extension when the check was written. Most rules live under `org.apache.kyuubi.plugin.spark.authz.rule` now — 21 files there against 9 in `ranger` — so a rule added there is outside the denylist. Nothing is reachable through that gap today. `spark.sql.optimizer.excludedRules` filters optimizer batches only, and Spark has no analyzer counterpart, so the resolution rules that apply masking and row filtering cannot be excluded at all. Of the rules `RangerSparkExtension` injects, four are optimizer rules: `RuleAuthorization` in `…authz.ranger`, which the check already covers, and `RuleEliminateMarker`, `RuleEliminatePermanentViewMarker` and `RuleEliminateTypeOf` in `…authz.rule`, which only strip markers after the check has run. Excluding one of those three breaks the query instead of lifting a check: with the extension and the test policies loaded, excluding `RuleEliminateMarker` fails planning with `No plan for RowFilterMarker +- DataMaskingStage0Marker …`, `RuleEliminatePermanentViewMarker` fails the same way, `RuleEliminateTypeOf` fails at runtime, and a user without privileges on the table stays denied with all three excluded. So this is future-proofing for rules that land under `…authz.rule` rather than closing a live bypass, and it does reject configurations that are accepted today — which is why it is separate from #7623 rather than part of it. Raised by @wForget in review of #7637; cc @cfmcgrady @pan3793. ### Motivation The denylist should not depend on where a rule happens to live, or on the accident that excluding the current cleanup rules breaks the query rather than lifting a check. ### Describe the solution Widen the package the check matches from `org.apache.kyuubi.plugin.spark.authz.ranger` to `org.apache.kyuubi.plugin.spark.authz`, and cover the three `…authz.rule` rules in `AuthzConfigurationCheckerSuite`. ### Additional context _No response_ ### Are you willing to submit PR? - [X] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve. - [ ] No. I cannot submit a PR at this time. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
