Cannot write system information on Graceful Shutdown

[florianMalbranque]

I am running:

• Trino 450
• config: management.user=admin-management
• access-control:

    {
      "impersonation": [
          {
              "original_user": ".*",
              "new_user": ".*"
          }
      ],
      "catalogs": [
            {
              "group": ".*",
              "allow": "all"
            }
          ],
      "procedures": [
        {
          "group": ".*",
          "catalog": ".*",
          "procedure": ".*",
          "privileges": [
          "EXECUTE"
          ]
        }
      ],
      "system_information": [
        {
          "user": ".*",
          "allow": ["read","write"]
        }
      ]
    }

When trying to run shutdown command within the worker pod:

$ curl -v -X PUT -d '"SHUTTING_DOWN"' -H "Content-type: application/json" \
    --insecure \
    http://localhost:8080/v1/info/state 
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> PUT /v1/info/state HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.76.1
> Accept: */*
> Content-type: application/json
> Content-Length: 15
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Date: Fri, 05 Jul 2024 08:53:28 GMT
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Length: 0
< 
* Connection #0 to host localhost left intact

Logs Coordinator:

2024-07-05T08:59:19.246Z    DEBUG    http-worker-124    io.trino.security.AccessControl    Invocation of checkCanSetUser(principal=Optional[admin-management], userName='admin-management') succeeded in 680.86us
2024-07-05T08:59:19.246Z    DEBUG    http-worker-124    io.trino.security.AccessControl    Invocation of checkCanReadSystemInformation(identity=Identity{user='admin-management', groups=[admin], principal=admin-management}) succeeded in 30.41us

Logs Worker:

2024-07-05T08:53:28.164Z    DEBUG    http-worker-104    io.trino.security.AccessControl    Invocation of checkCanSetUser(principal=Optional[admin-management], userName='admin-management') succeeded in 553.10us
2024-07-05T08:53:28.165Z    DEBUG    http-worker-104    io.trino.security.AccessControl    Invocation of checkCanWriteSystemInformation(identity=Identity{user='admin-management', principal=admin-management}) took 452.98us and failed with io.trino.spi.security.AccessDeniedException: Access Denied: Cannot write system information

I suspect a bug in system information permission handling

[hashhar]

Do you have the access control configs on the worker too?

[florianMalbranque]

@hashhar Yes

[florianMalbranque]

@hashhar, After double checking, helm trino chart was not deploying AC config to Workers, the above PR aims to fix it, I'll close this issue