milvus-io / milvus

A cloud-native vector database, storage for next generation AI applications
https://milvus.io
Apache License 2.0
29.26k stars 2.81k forks source link

[Bug]: policy related metadataCache got removed and lead to permission denied errors #34667

Closed balloon1995 closed 2 weeks ago

balloon1995 commented 1 month ago

Is there an existing issue for this?

Environment

- Milvus version:2.3.5
- Deployment mode(standalone or cluster):cluster
- MQ type(rocksmq, pulsar or kafka):    pulsar
- SDK version(e.g. pymilvus v2.0.0rc2):
- OS(Ubuntu or CentOS): 
- CPU/Memory: 
- GPU: 
- Others:

Current Behavior

com.paypal.dataprocessing.search.pojo.VectorSearchRequest@12ea29c5&io.grpc.StatusRuntimeException: PERMISSION_DENIED: PrivilegeSearch: permission deny to xxxx at io.grpc.stub.ClientCalls.toStatusRuntimeException(ClientCalls.java:268) at io.grpc.stub.ClientCalls.getUnchecked(ClientCalls.java:249) at io.grpc.stub.ClientCalls.blockingUnaryCall(ClientCalls.java:167) at io.milvus.grpc.MilvusServiceGrpc$MilvusServiceBlockingStub.search(MilvusServiceGrpc.java:4217) at io.milvus.client.AbstractMilvusGrpcClient.search(AbstractMilvusGrpcClient.java:1596) at com.paypal.vector.milvus.client.TlsMilvusServiceClient.lambda$search$35(TlsMilvusServiceClient.java:477) at com.paypal.vector.milvus.client.TlsMilvusServiceClient.retry(TlsMilvusServiceClient.java:226) at com.paypal.vector.milvus.client.TlsMilvusServiceClient.search(TlsMilvusServiceClient.java:477) at com.paypal.vector.milvus.client.MilvusServiceDRClient.search(MilvusServiceDRClient.java:305) at com.paypal.vector.milvus.utils.MilvusUtils.searchVector(MilvusUtils.java:284) at com.paypal.dataprocessing.search.service.VectorSearchService.doSearch(VectorSearchService.java:135) at com.paypal.dataprocessing.search.impl.VectorSearchControllerImpl.vectorSearch(VectorSearchControllerImpl.java:69) at jdk.internal.reflect.GeneratedMethodAccessor173.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130) at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:524) at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:474)###

Expected Behavior

keep previous metadataCache instead of removing it when the response is invalid

Steps To Reproduce

No response

Milvus Log

[2024/07/04 00:59:56.173 +00:00] [INFO] [proxy/privilege_interceptor.go:176] ["permission deny"] [username=xxxx] [role_names="[public]"] [object_type=Collection] [object_privilege=PrivilegeLoad] [db_name=default] [object_index=2] [object_name=xxxxxxxx] [object_indexs=0] [object_names="[]"] [roles="[public]"] ....

Anything else?

No response

yanliang567 commented 1 month ago

/assign @congqixia please help to review the issue and pr, thanks /unassign

xiaofan-luan commented 1 month ago

/assign @SimFG please help on reviewing it

SimFG commented 1 month ago

@xiaofan-luan ok, i will check it.

stale[bot] commented 2 weeks ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. Rotten issues close after 30d of inactivity. Reopen the issue with /reopen.

SimFG commented 2 weeks ago

/close

sre-ci-robot commented 2 weeks ago

@SimFG: Closing this issue.

In response to [this](https://github.com/milvus-io/milvus/issues/34667#issuecomment-2295555766): >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.