apache / kyuubi

Apache Kyuubi is a distributed and multi-tenant gateway to provide serverless SQL on data warehouses and lakehouses.
https://kyuubi.apache.org/
Apache License 2.0
2.11k stars 915 forks source link

[Bug] [AUTHZ] Table owner can not update/delete hudi tables they have created #6718

Open maomaodev opened 1 month ago

maomaodev commented 1 month ago

Code of Conduct

Search before asking

Describe the bug

Kyuubi version 1.9.0, Spark version 3.4.2, Hudi version 0.14.1

  1. In Ranger, the user "user_read" has only the permission to create tables, and for "all - database, table, column", the {owner} has ALL permissions.
  2. The user "user_read" can successfully create Hudi tables and perform normal inserts. create table hudi_db.hudi_t(id bigint, name string, price double, part string) using hudi tblproperties (type='cow',primaryKey ='id'); insert into hudi_db.hudi_t values(100, 'apple', 80.5,'part1'),(200, 'apple', 80.5,'part2');
  3. The user "user_read" does not have the permission to update/delete the Hudi tables created. update hudi_db.hudi_t set id =150 where id=100; The error message is as follows: [ERROR] [main] Failed in [update hudi_db.hudi_t set id =150 where id=100] (org.apache.spark.sql.hive.thriftserver.SparkSQLDriver(org.apache.spark.internal.Logging.logError:97)) org.apache.kyuubi.plugin.spark.authz.AccessControlException: Permission denied: user [user_read] does not have [update] privilege on [hudi_db/hudi_t]

Affects Version(s)

1.9.0/1.9.2

Kyuubi Server Log Output

No response

Kyuubi Engine Log Output

No response

Kyuubi Server Configurations

No response

Kyuubi Engine Configurations

No response

Additional context

No response

Are you willing to submit PR?

github-actions[bot] commented 1 month ago

Hello @maomaodev, Thanks for finding the time to report the issue! We really appreciate the community's efforts to improve Apache Kyuubi.