vinhhap commented on PR #7594: URL: https://github.com/apache/kyuubi/pull/7594#issuecomment-6162689250
Sharing evaluation data from a self-hosted deployment (Spark **4.2.0** / Scala 2.13, Iceberg **1.13.0** via an Iceberg REST catalog, shaded `_2.13` build from source). We merged this branch with #7741's head in a scratch tree and ran an isolated two-principal driver against real v2 `DataSourceV2Relation` reads. **Coordination note:** the two PRs conflict on `TableTableExtractor.apply` (both rewrite it). Our union resolution: #7741's `getIcebergDataTableName` → this PR's `metadataTableBaseName` → legacy `name()`. May be worth sequencing the two merges so upstream owns that resolution. **Observations (all with this branch's code):** - The new suites are green on the merged tree at the 4.2 profile (`ParanoidModeSuite` + `ClassificationCoverageSuite`, 23 tests). - Column-referencing Iceberg reads deny without a grant in `warn` and `deny`; column masks and row filters apply on the REST-catalog relation. - `t.history/.files/.partitions/.changes` deny naming **base-table** columns (with #7741's changelog mapping); MERGE/UPDATE/DELETE deny on the embedded target scan. - `SET` and `RESET` of `spark.kyuubi.authz.unclassifiedNode.behavior` are rejected (`AuthzConfigurationChecker.scala:68`) and a SparkConf-API re-set is a no-op — the review's first point looks closed from the outside. - The cached `InMemoryRelation` concern (review's second point) did **not** reproduce for us: after a live revoke, cached column-referencing reads denied, and a cross-user cached read denied. Caveat: our topology is one principal per JVM, which limits the cross-user case. **Two things reviewers may want to check:** 1. Columnless projections (`SELECT count(*)`, `SELECT 1`) are allowed for an ungranted principal **even under `deny`** (no column references ⇒ no privilege objects). If intended, documenting it would help; if not, it sits next to the constant-projection layer already fixed. 2. On Spark 4.2 the `CALL` spec appears **reachable** despite the documented §7 limitation: an unprivileged `CALL` denied on `[alter]`, and with principal-isolated JVMs the procedure body was never entered before the deny (stderr inspection); an `alter`-granted `CALL` passed authz and executed. Possibly the dispatch hardening changed reachability — worth reconfirming the limitation text. Happy to paste the probe scripts if useful. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
