Introduce System Repository #9088
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
Bukhtawar
requested review from
reta,
anasalkouz,
andrross,
CEHENKLE,
dblock,
gbbafna,
setiah,
kartg,
kotwanikunal,
mch2,
nknize,
owaiskazi19,
Rishikesh1159,
ryanbogan,
saratvemulapalli,
shwetathareja,
dreamer-89,
tlfeng,
VachaShah,
dbwiddis,
sachinpkale and
sohami
as code owners
Gradle Check (Jenkins) Run Completed with:
|
|
Compatibility status: |
|
looks good on a high level 🎉 we also need to protect from deletions as well . |
linuxpi
reviewed
Aug 4, 2023
| @@ -159,7 +160,7 @@ public RepositoriesService( | |||
| * @param request register repository request | |||
| * @param listener register repository listener | |||
| */ | |||
| public void registerRepository(final PutRepositoryRequest request, final ActionListener<ClusterStateUpdateResponse> listener) { | |||
| public void registerOrUpdateRepository(final PutRepositoryRequest request, final ActionListener<ClusterStateUpdateResponse> listener) { | |||
There was a problem hiding this comment.
When we try to register a new system repository, do we call this method? or that flow would be separate?
There was a problem hiding this comment.
That should be a separate flow
Gradle Check (Jenkins) Run Completed with:
|
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
|
Compatibility status: |
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
|
Compatibility status: |
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
|
Compatibility status: |
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
gbbafna
reviewed
Aug 8, 2023
| repositoriesMetadata.add(newRepositoryMetadata); | ||
| } else { | ||
| repositoriesMetadata.add(repositoryMetadata); | ||
| } | ||
| } | ||
| if (!found) { | ||
| logger.info("put repository [{}]", request.name()); | ||
| ensureNonSystemRepository(newRepositoryMetadata.settings(), newRepositoryMetadata.name()); |
There was a problem hiding this comment.
can we move this earlier where we also do We will anyways need this check here as we want this to be atomic .validateRepositoryMetadataSettings ?
gbbafna
reviewed
Aug 8, 2023
| repositoriesMetadata.add(new RepositoryMetadata(request.name(), request.type(), request.settings())); | ||
| } else { | ||
| logger.info("update repository [{}]", request.name()); | ||
| validateRestrictedSystemRepositorySettings(currentRepositoryMetadata, newRepositoryMetadata); |
There was a problem hiding this comment.
we should also restrict changing type .
gbbafna
reviewed
Aug 8, 2023
| @@ -499,6 +518,22 @@ public Repository repository(String repositoryName) { | |||
| throw new RepositoryMissingException(repositoryName); | |||
| } | |||
|
|
|||
| /** | |||
| * Returns registered system repository | |||
There was a problem hiding this comment.
this is to make sure we always use system repository for remote store .
| @@ -288,6 +317,7 @@ public ClusterState execute(ClusterState currentState) { | |||
| boolean changed = false; | |||
| for (RepositoryMetadata repositoryMetadata : repositories.repositories()) { | |||
| if (Regex.simpleMatch(request.name(), repositoryMetadata.name())) { | |||
| ensureNonSystemRepository(repositoryMetadata.settings(), request.name()); | |||
There was a problem hiding this comment.
The error message would be confusing here : cannot register a system repository externally . We need to modify it .
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
|
Compatibility status: |
Gradle Check (Jenkins) Run Completed with:
|
Signed-off-by: Bukhtawar Khan <bukhtawa@amazon.com>
|
Compatibility status: |
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
|
Test Failure : #9186 |
Gradle Check (Jenkins) Run Completed with:
|
Gradle Check (Jenkins) Run Completed with:
|
| ); | ||
| } | ||
| Repository repository = repositories.get(currentRepositoryMetadata.name()); | ||
| for (Setting<?> setting : repository.restrictedSystemRepositorySettings()) { |
There was a problem hiding this comment.
REMOTE_STORE_INDEX_SHALLOW_COPY setting will be in snapshot repository. for that, we need to add validation in non system repository as well. or should we make snapshot repository as well a system repository once user enables shallow snapshots on it?
4 tasks
|
This PR is stalled because it has been open for 30 days with no activity. |
|
This draft PR has been stalled for a few weeks. Please re-open if you are still working on it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
The PR aims to introduce a system repository, that hardens repository interfaces. A repository can be marked as system repository by annotating the repository with the attribute
system_repositoryto true. A system repository cannot be modified by external APIs once created.Related Issues
Resolves #8917
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.