Skip to content

Commit 5807f62

Browse files
doroolegdorooleg
authored
shared secrets have been supported (#9553)
1 parent ddd43c1 commit 5807f62

File tree

4 files changed

+102
-11
lines changed

4 files changed

+102
-11
lines changed

‎ydb/core/external_sources/s3/ut/s3_aws_credentials_ut.cpp‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ Y_UNIT_TEST_SUITE(S3AwsCredentials) {
6161
AWS_ACCESS_KEY_ID_SECRET_NAME="id",
6262
AWS_SECRET_ACCESS_KEY_SECRET_NAME="key",
6363
AWS_REGION="ru-central-1"
64-
);)",
64+
);
65+
GRANT ALL ON `{external_source}` TO `root1@builtin`;
66+
)",
6567
"external_source"_a = externalDataSourceName,
6668
"location"_a = "localhost:" + GetExternalPort("minio", "9000") + "/datalake/"
6769
);
@@ -125,6 +127,64 @@ Y_UNIT_TEST_SUITE(S3AwsCredentials) {
125127
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(0).GetUtf8(), "2");
126128
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(1).GetUtf8(), "hello world");
127129
}
130+
131+
{
132+
auto db = kikimr->GetQueryClient(NYdb::NQuery::TClientSettings().AuthToken("root1@builtin"));
133+
{
134+
auto scriptExecutionOperation = db.ExecuteScript(fmt::format(R"(
135+
SELECT * FROM `{external_source}`.`/a/` WITH (
136+
format="json_each_row",
137+
schema(
138+
key Utf8 NOT NULL,
139+
value Utf8 NOT NULL
140+
)
141+
)
142+
)", "external_source"_a = externalDataSourceName)).ExtractValueSync();
143+
UNIT_ASSERT_VALUES_EQUAL_C(scriptExecutionOperation.Status().GetStatus(), EStatus::SUCCESS, scriptExecutionOperation.Status().GetIssues().ToString());
144+
UNIT_ASSERT(scriptExecutionOperation.Metadata().ExecutionId);
145+
146+
NYdb::NQuery::TScriptExecutionOperation readyOp = WaitScriptExecutionOperation(scriptExecutionOperation.Id(), kikimr->GetDriver());
147+
UNIT_ASSERT_EQUAL_C(readyOp.Metadata().ExecStatus, EExecStatus::Failed, readyOp.Status().GetIssues().ToString());
148+
UNIT_ASSERT_STRING_CONTAINS_C(readyOp.Status().GetIssues().ToString(), "secret with name 'id' not found", readyOp.Status().GetIssues().ToString());
149+
}
150+
{
151+
const TString query = R"(
152+
CREATE OBJECT `id:root1@builtin` (TYPE SECRET_ACCESS);
153+
CREATE OBJECT `key:root1@builtin` (TYPE SECRET_ACCESS);
154+
)";
155+
auto result = session.ExecuteSchemeQuery(query).GetValueSync();
156+
UNIT_ASSERT_C(result.GetStatus() == NYdb::EStatus::SUCCESS, result.GetIssues().ToString());
157+
}
158+
{
159+
auto scriptExecutionOperation = db.ExecuteScript(fmt::format(R"(
160+
SELECT * FROM `{external_source}`.`/a/` WITH (
161+
format="json_each_row",
162+
schema(
163+
key Utf8 NOT NULL,
164+
value Utf8 NOT NULL
165+
)
166+
)
167+
)", "external_source"_a = externalDataSourceName)).ExtractValueSync();
168+
UNIT_ASSERT_VALUES_EQUAL_C(scriptExecutionOperation.Status().GetStatus(), EStatus::SUCCESS, scriptExecutionOperation.Status().GetIssues().ToString());
169+
UNIT_ASSERT(scriptExecutionOperation.Metadata().ExecutionId);
170+
171+
NYdb::NQuery::TScriptExecutionOperation readyOp = WaitScriptExecutionOperation(scriptExecutionOperation.Id(), kikimr->GetDriver());
172+
UNIT_ASSERT_EQUAL_C(readyOp.Metadata().ExecStatus, EExecStatus::Completed, readyOp.Status().GetIssues().ToString());
173+
TFetchScriptResultsResult results = db.FetchScriptResults(scriptExecutionOperation.Id(), 0).ExtractValueSync();
174+
UNIT_ASSERT_C(results.IsSuccess(), results.GetIssues().ToString());
175+
176+
TResultSetParser resultSet(results.ExtractResultSet());
177+
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnsCount(), 2);
178+
UNIT_ASSERT_VALUES_EQUAL(resultSet.RowsCount(), 2);
179+
UNIT_ASSERT(resultSet.TryNextRow());
180+
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(0).GetUtf8(), "1");
181+
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(1).GetUtf8(), "trololo");
182+
UNIT_ASSERT(resultSet.TryNextRow());
183+
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(0).GetUtf8(), "2");
184+
UNIT_ASSERT_VALUES_EQUAL(resultSet.ColumnParser(1).GetUtf8(), "hello world");
185+
}
186+
}
187+
128188
}
129189
}
130190

‎ydb/core/kqp/federated_query/kqp_federated_query_actors.cpp‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,31 @@ class TDescribeSecretsActor: public NActors::TActorBootstrapped<TDescribeSecrets
2020
secretValues.reserve(SecretIds.size());
2121
for (const auto& secretId: SecretIds) {
2222
TString secretValue;
23-
const bool isFound = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretId), secretValue);
24-
if (!isFound) {
25-
if (!AskSent) {
26-
AskSent = true;
27-
Send(NMetadata::NProvider::MakeServiceId(SelfId().NodeId()), new NMetadata::NProvider::TEvAskSnapshot(GetSecretsSnapshotParser()));
28-
} else {
29-
CompleteAndPassAway(TEvDescribeSecretsResponse::TDescription(Ydb::StatusIds::BAD_REQUEST, { NYql::TIssue("secret with name '" + secretId.GetSecretId() + "' not found") }));
30-
}
23+
bool isFound = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretId), secretValue);
24+
if (isFound) {
25+
secretValues.push_back(secretValue);
26+
continue;
27+
}
28+
29+
auto secretIds = snapshot->GetSecretIds(UserToken, secretId.GetSecretId());
30+
if (secretIds.size() > 1) {
31+
CompleteAndPassAway(TEvDescribeSecretsResponse::TDescription(Ydb::StatusIds::BAD_REQUEST, { NYql::TIssue("several secrets with name '" + secretId.GetSecretId() + "' were found") }));
3132
return;
3233
}
33-
secretValues.push_back(secretValue);
34+
35+
isFound = !secretIds.empty() && snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretIds[0]), secretValue);
36+
if (isFound) {
37+
secretValues.push_back(secretValue);
38+
continue;
39+
}
40+
41+
if (!AskSent) {
42+
AskSent = true;
43+
Send(NMetadata::NProvider::MakeServiceId(SelfId().NodeId()), new NMetadata::NProvider::TEvAskSnapshot(GetSecretsSnapshotParser()));
44+
} else {
45+
CompleteAndPassAway(TEvDescribeSecretsResponse::TDescription(Ydb::StatusIds::BAD_REQUEST, { NYql::TIssue("secret with name '" + secretId.GetSecretId() + "' not found") }));
46+
}
47+
return;
3448
}
3549

3650
CompleteAndPassAway(TEvDescribeSecretsResponse::TDescription(secretValues));
@@ -49,7 +63,8 @@ class TDescribeSecretsActor: public NActors::TActorBootstrapped<TDescribeSecrets
4963

5064
public:
5165
TDescribeSecretsActor(const TString& ownerUserId, const std::vector<TString>& secretIds, NThreading::TPromise<TEvDescribeSecretsResponse::TDescription> promise)
52-
: SecretIds(CreateSecretIds(ownerUserId, secretIds))
66+
: UserToken(NACLib::TUserToken{ownerUserId, TVector<NACLib::TSID>{}})
67+
, SecretIds(CreateSecretIds(ownerUserId, secretIds))
5368
, Promise(promise)
5469
{}
5570

@@ -74,6 +89,7 @@ class TDescribeSecretsActor: public NActors::TActorBootstrapped<TDescribeSecrets
7489
}
7590

7691
private:
92+
std::optional<NACLib::TUserToken> UserToken;
7793
const std::vector<NMetadata::NSecret::TSecretId> SecretIds;
7894
NThreading::TPromise<TEvDescribeSecretsResponse::TDescription> Promise;
7995
bool AskSent = false;

‎ydb/services/metadata/secret/snapshot.cpp‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,4 +75,18 @@ bool TSnapshot::GetSecretValue(const TSecretIdOrValue& sId, TString& result) con
7575
return true;
7676
}
7777

78+
std::vector<TSecretId> TSnapshot::GetSecretIds(const std::optional<NACLib::TUserToken>& userToken, const TString& secretId) const {
79+
std::vector<TSecretId> secretIds;
80+
for (const auto& [key, value]: Secrets) {
81+
if (key.GetSecretId() != secretId) {
82+
continue;
83+
}
84+
if (!CheckSecretAccess(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(key), userToken)) {
85+
continue;
86+
}
87+
secretIds.push_back(key);
88+
}
89+
return secretIds;
90+
}
91+
7892
}

‎ydb/services/metadata/secret/snapshot.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ class TSnapshot: public NFetcher::ISnapshot {
2121
bool CheckSecretAccess(const TSecretIdOrValue& sIdOrValue, const std::optional<NACLib::TUserToken>& userToken) const;
2222
bool PatchString(TString& stringForPath) const;
2323
bool GetSecretValue(const TSecretIdOrValue& secretId, TString& result) const;
24+
std::vector<TSecretId> GetSecretIds(const std::optional<NACLib::TUserToken>& userToken, const TString& secretId) const;
2425
};
2526

2627
}

0 commit comments

Comments
 (0)