Skip to content

S3 ChangeLog store with filtered domain support#3240

Closed
havetisyan wants to merge 1 commit intomasterfrom
filter-s3
Closed

S3 ChangeLog store with filtered domain support#3240
havetisyan wants to merge 1 commit intomasterfrom
filter-s3

Conversation

@havetisyan
Copy link
Copy Markdown
Collaborator

@havetisyan havetisyan commented Mar 17, 2026

Description

can be used with #3238 to have an ZTS instance allocated for user certs only

Contribution Checklist:

  • The pull request does not introduce any breaking changes
  • I have read the contribution guidelines.
  • Create an issue and link to the pull request.

Attach Screenshots (Optional)

Signed-off-by: Henry Avetisyan <hga@yahooinc.com>
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new S3 ChangeLog store implementation that supports filtering domains. This enhancement allows ZTS instances to be configured to only process and load data for a specific subset of domains from S3, which is particularly useful for deployments focused on user certificate issuance, reducing load and resource consumption by avoiding the need to monitor and load all domain data.

Highlights

  • Introduced S3FilteredChangeLogStore: A new class that extends S3ChangeLogStore to provide domain-specific filtering capabilities.
  • Enhanced S3ChangeLogStore: Modified the base S3 ChangeLog store to include a new listObjects method that accepts an optional domain filter, enabling selective listing of S3 objects.
  • Added S3FilteredChangeLogStoreFactory: A factory class to instantiate the S3FilteredChangeLogStore, configured via a system property specifying the supported domains.
  • Comprehensive Unit Tests: Included new test classes to ensure the correct functionality of the S3FilteredChangeLogStore and its factory, covering various filtering scenarios.
Changelog
  • libs/java/server_aws_common/src/main/java/io/athenz/server/aws/common/store/impl/S3ChangeLogStore.java
    • Changed access modifiers of s3BucketName, awsRegion, jsonMapper, and jwsDomainSupport fields from private to protected to allow subclass access.
    • Overloaded the listObjects method to include an optional Set domainFilter parameter.
    • Implemented logic within the listObjects method to filter S3 objects based on the provided domainFilter set, ensuring only supported domains are processed.
  • libs/java/server_aws_common/src/main/java/io/athenz/server/aws/common/store/impl/S3FilteredChangeLogStore.java
    • Added a new class S3FilteredChangeLogStore which extends S3ChangeLogStore.
    • Implemented a constructor that takes a Set supportedDomains and initializes the superclass.
    • Overrode the listObjects method to pass the supportedDomains set to the superclass's new filtered listObjects method.
  • libs/java/server_aws_common/src/main/java/io/athenz/server/aws/common/store/impl/S3FilteredChangeLogStoreFactory.java
    • Added a new class S3FilteredChangeLogStoreFactory which implements ChangeLogStoreFactory.
    • Provided a create method that reads the athenz.zts.s3_change_log_store_filter system property, parses it into a set of domains, and instantiates an S3FilteredChangeLogStore with these domains.
    • Added validation to ensure the filter property is present and contains at least one domain.
  • libs/java/server_aws_common/src/test/java/io/athenz/server/aws/common/store/impl/S3FilteredChangeLogStoreFactoryTest.java
    • Added a new test class S3FilteredChangeLogStoreFactoryTest.
    • Included tests for create method with null, valid, multiple, and whitespace-padded domain filters, asserting correct instantiation and error handling.
  • libs/java/server_aws_common/src/test/java/io/athenz/server/aws/common/store/impl/S3FilteredChangeLogStoreTest.java
    • Added a new test class S3FilteredChangeLogStoreTest.
    • Provided tests for listObjects method covering scenarios like no modification time, with modification time, multiple S3 listing pages, empty filter, and skipping hidden domains.
    • Included tests for getServerDomainList and getLocalDomainList to verify domain filtering.
Activity
  • No human activity has been recorded on this pull request yet.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a filtered version of the S3ChangeLogStore, allowing domain lists to be filtered based on a configured set of supported domains. This is achieved by creating a new S3FilteredChangeLogStore and a corresponding S3FilteredChangeLogStoreFactory. The base S3ChangeLogStore is updated to support this extension by changing member visibility and adding an overloaded method for filtering.

The overall approach is sound and the new functionality is well-tested. I have a couple of suggestions for improvement: one to remove redundant initialization code in the new S3FilteredChangeLogStore, and another to make the parsing of the filter property in S3FilteredChangeLogStoreFactory more robust.

Comment on lines +30 to +31
super.init();
super.initAwsRegion();
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The calls to super.init() and super.initAwsRegion() are redundant. The superclass's default constructor, which is implicitly called as the first operation in this constructor, already performs this initialization. Removing these lines will prevent the initialization logic from executing twice.

Comment on lines +57 to +59
for (String domain : filter.split(",")) {
domains.add(domain.trim());
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The current logic for parsing the domain filter property is not robust against empty or whitespace-only values (e.g., "", " ", ","). This can result in a Set containing an empty string, which is likely not intended and would not be caught by the domains.isEmpty() check on line 61. It's better to filter out empty strings while populating the set.

        for (String domain : filter.split(",")) {
            String trimmedDomain = domain.trim();
            if (!trimmedDomain.isEmpty()) {
                domains.add(trimmedDomain);
            }
        }

@havetisyan havetisyan closed this Mar 17, 2026
@havetisyan havetisyan deleted the filter-s3 branch March 17, 2026 23:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant