Skip to content

Commit c063aca

Browse files
binary-signalbinary-signal
authored
Merge branch 'apache:main' into main
2 parents 5f649f3 + 9a299db commit c063aca

File tree

11 files changed

+465
-17
lines changed

11 files changed

+465
-17
lines changed

‎fluss-flink/fluss-flink-common/src/main/java/org/apache/fluss/flink/lake/LakeSplitGenerator.java‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -235,10 +235,15 @@ private List<SourceSplitBase> generateSplit(
235235
Long snapshotLogOffset = tableBucketSnapshotLogOffset.get(tableBucket);
236236
Long stoppingOffset = bucketEndOffset.get(bucket);
237237
if (snapshotLogOffset == null) {
238-
// no any data commit to this bucket, scan from fluss log
239-
splits.add(
240-
new LogSplit(
241-
tableBucket, partitionName, EARLIEST_OFFSET, stoppingOffset));
238+
// no data committed to lake for this bucket, scan from fluss log
239+
if (stoppingOffset == NO_STOPPING_OFFSET || stoppingOffset > 0) {
240+
splits.add(
241+
new LogSplit(
242+
tableBucket,
243+
partitionName,
244+
EARLIEST_OFFSET,
245+
stoppingOffset));
246+
}
242247
} else {
243248
// need to read remain fluss log
244249
if (stoppingOffset == NO_STOPPING_OFFSET

‎helm/templates/_security.tpl‎

Lines changed: 89 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,28 @@ Usage:
2929
{{- $mechanism -}}
3030
{{- end -}}
3131

32+
{{/*
33+
Returns the ZooKeeper SASL authentication mechanism value.
34+
Allowed mechanism values: '', 'plain'
35+
Usage:
36+
include "fluss.security.zookeeper.sasl.mechanism" .
37+
*/}}
38+
{{- define "fluss.security.zookeeper.sasl.mechanism" -}}
39+
{{- $sasl := .Values.security.zookeeper.sasl | default (dict) -}}
40+
{{- $mechanism := lower (default "" $sasl.mechanism) -}}
41+
{{- $mechanism -}}
42+
{{- end -}}
43+
44+
{{/*
45+
Returns true if ZooKeeper SASL authentication is enabled (mechanism is non-empty).
46+
Usage:
47+
include "fluss.security.zookeeper.sasl.enabled" .
48+
*/}}
49+
{{- define "fluss.security.zookeeper.sasl.enabled" -}}
50+
{{- $mechanism := include "fluss.security.zookeeper.sasl.mechanism" . -}}
51+
{{- if ne $mechanism "" -}}true{{- end -}}
52+
{{- end -}}
53+
3254
{{/*
3355
Returns true if any of the listeners uses SASL based authentication mechanism ('plain' for now).
3456
Usage:
@@ -117,6 +139,56 @@ Usage:
117139
{{- end -}}
118140
{{- end -}}
119141

142+
{{/*
143+
Validates that ZooKeeper SASL mechanism is valid.
144+
Returns an error message if invalid, empty string otherwise.
145+
Usage:
146+
include "fluss.security.zookeeper.sasl.validateMechanism" .
147+
*/}}
148+
{{- define "fluss.security.zookeeper.sasl.validateMechanism" -}}
149+
{{- $allowedMechanisms := list "" "plain" -}}
150+
{{- $mechanism := include "fluss.security.zookeeper.sasl.mechanism" . -}}
151+
{{- if not (has $mechanism $allowedMechanisms) -}}
152+
{{- print "security.zookeeper.sasl.mechanism must be empty or: plain" -}}
153+
{{- end -}}
154+
{{- end -}}
155+
156+
{{/*
157+
Validates that ZooKeeper SASL loginModuleClass is not empty when ZK SASL is enabled.
158+
Returns an error message if invalid, empty string otherwise.
159+
Usage:
160+
include "fluss.security.zookeeper.sasl.validateLoginModuleClass" .
161+
*/}}
162+
{{- define "fluss.security.zookeeper.sasl.validateLoginModuleClass" -}}
163+
{{- if and (include "fluss.security.zookeeper.sasl.enabled" .) (not .Values.security.zookeeper.sasl.plain.loginModuleClass) -}}
164+
{{- print "security.zookeeper.sasl.plain.loginModuleClass must not be empty when security.zookeeper.sasl.mechanism is plain" -}}
165+
{{- end -}}
166+
{{- end -}}
167+
168+
{{/*
169+
Validates that ZooKeeper SASL username is not empty when ZK SASL is enabled.
170+
Returns an error message if invalid, empty string otherwise.
171+
Usage:
172+
include "fluss.security.zookeeper.sasl.validateUsername" .
173+
*/}}
174+
{{- define "fluss.security.zookeeper.sasl.validateUsername" -}}
175+
{{- if and (include "fluss.security.zookeeper.sasl.enabled" .) (not .Values.security.zookeeper.sasl.plain.username) -}}
176+
{{- print "security.zookeeper.sasl.plain.username must not be empty when security.zookeeper.sasl.mechanism is plain" -}}
177+
{{- end -}}
178+
{{- end -}}
179+
180+
{{/*
181+
Validates that ZooKeeper SASL password is not empty when ZK SASL is enabled.
182+
Returns an error message if invalid, empty string otherwise.
183+
Usage:
184+
include "fluss.security.zookeeper.sasl.validatePassword" .
185+
*/}}
186+
{{- define "fluss.security.zookeeper.sasl.validatePassword" -}}
187+
{{- if and (include "fluss.security.zookeeper.sasl.enabled" .) (not .Values.security.zookeeper.sasl.plain.password) -}}
188+
{{- print "security.zookeeper.sasl.plain.password must not be empty when security.zookeeper.sasl.mechanism is plain" -}}
189+
{{- end -}}
190+
{{- end -}}
191+
120192
{{/*
121193
Returns the default internal SASL username based on the release name.
122194
Usage:
@@ -153,6 +225,17 @@ Usage:
153225
{{- .Values.security.internal.sasl.plain.password | default (include "fluss.security.sasl.plain.internal.defaultPassword" .) -}}
154226
{{- end -}}
155227

228+
{{/*
229+
Returns true if JAAS configuration is required, either by listeners using SASL protocol or ZooKeeper SASL enablement.
230+
Usage:
231+
include "fluss.security.jaas.required" .
232+
*/}}
233+
{{- define "fluss.security.jaas.required" -}}
234+
{{- if or (include "fluss.security.sasl.enabled" .) (include "fluss.security.zookeeper.sasl.enabled" .) -}}
235+
{{- true -}}
236+
{{- end -}}
237+
{{- end -}}
238+
156239
{{/*
157240
Returns a warning if the internal SASL user is using auto-generated credentials.
158241
Usage:
@@ -179,6 +262,10 @@ Usage:
179262
{{- $errMessages := list -}}
180263
{{- $errMessages = append $errMessages (include "fluss.security.sasl.validateMechanisms" .) -}}
181264
{{- $errMessages = append $errMessages (include "fluss.security.sasl.validateClientPlainUsers" .) -}}
265+
{{- $errMessages = append $errMessages (include "fluss.security.zookeeper.sasl.validateMechanism" .) -}}
266+
{{- $errMessages = append $errMessages (include "fluss.security.zookeeper.sasl.validateLoginModuleClass" .) -}}
267+
{{- $errMessages = append $errMessages (include "fluss.security.zookeeper.sasl.validateUsername" .) -}}
268+
{{- $errMessages = append $errMessages (include "fluss.security.zookeeper.sasl.validatePassword" .) -}}
182269

183270
{{- $errMessages = without $errMessages "" -}}
184271
{{- $errMessage := join "\n" $errMessages -}}
@@ -202,8 +289,8 @@ Usage:
202289
{{/*
203290
Returns the SASL JAAS config name.
204291
Usage:
205-
include "fluss.security.sasl.configName" .
292+
include "fluss.security.jaas.configName" .
206293
*/}}
207-
{{- define "fluss.security.sasl.configName" -}}
294+
{{- define "fluss.security.jaas.configName" -}}
208295
{{ include "fluss.fullname" . }}-sasl-jaas-config
209296
{{- end -}}

‎helm/templates/configmap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,9 @@ data:
5353
{{- end }}
5454
5555
{{- end }}
56+
57+
### Zookeeper
58+
59+
{{- if (include "fluss.security.zookeeper.sasl.enabled" .) }}
60+
zookeeper.client.config.path: /etc/fluss/conf/zookeeper-client.properties
61+
{{- end }}

‎helm/templates/secret-jaas-config.yaml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,21 @@
1616
# limitations under the License.
1717
#
1818

19-
{{ if (include "fluss.security.sasl.plain.enabled" .) }}
19+
{{ if (include "fluss.security.jaas.required" .) }}
2020
{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
2121
{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
2222
{{- $internalUsername := include "fluss.security.sasl.plain.internal.username" . -}}
2323
{{- $internalPassword := include "fluss.security.sasl.plain.internal.password" . -}}
2424
apiVersion: v1
2525
kind: Secret
2626
metadata:
27-
name: {{ include "fluss.security.sasl.configName" . }}
27+
name: {{ include "fluss.security.jaas.configName" . }}
2828
labels:
2929
{{- include "fluss.labels" . | nindent 4 }}
3030
type: Opaque
3131
stringData:
3232
jaas.conf: |
33+
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
3334
{{- if eq $internalMechanism "plain" }}
3435
internal.FlussServer {
3536
org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required
@@ -49,4 +50,16 @@ stringData:
4950
{{- end }};
5051
};
5152
{{- end }}
53+
{{- end }}
54+
{{- if (include "fluss.security.zookeeper.sasl.enabled" .) }}
55+
ZookeeperClient {
56+
{{ .Values.security.zookeeper.sasl.plain.loginModuleClass }} required
57+
username="{{ .Values.security.zookeeper.sasl.plain.username }}"
58+
password="{{ .Values.security.zookeeper.sasl.plain.password }}";
59+
};
60+
{{- end }}
61+
{{- if (include "fluss.security.zookeeper.sasl.enabled" .) }}
62+
zookeeper-client.properties: |
63+
zookeeper.sasl.clientconfig=ZookeeperClient
64+
{{- end }}
5265
{{- end -}}

‎helm/templates/sts-coordinator.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ spec:
6060
valueFrom:
6161
fieldRef:
6262
fieldPath: status.hostIP
63-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
63+
{{- if (include "fluss.security.jaas.required" .) }}
6464
- name: FLUSS_ENV_JAVA_OPTS
6565
value: "-Djava.security.auth.login.config=/etc/fluss/conf/jaas.conf"
6666
{{- end }}
@@ -105,7 +105,7 @@ spec:
105105
mountPath: /opt/conf
106106
- name: data
107107
mountPath: /tmp/fluss/data
108-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
108+
{{- if (include "fluss.security.jaas.required" .) }}
109109
- name: sasl-config
110110
mountPath: /etc/fluss/conf
111111
readOnly: true
@@ -118,10 +118,10 @@ spec:
118118
- name: data
119119
emptyDir: {}
120120
{{- end }}
121-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
121+
{{- if (include "fluss.security.jaas.required" .) }}
122122
- name: sasl-config
123123
secret:
124-
secretName: {{ include "fluss.security.sasl.configName" . }}
124+
secretName: {{ include "fluss.security.jaas.configName" . }}
125125
{{- end }}
126126
{{- if .Values.coordinator.storage.enabled }}
127127
volumeClaimTemplates:

‎helm/templates/sts-tablet.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ spec:
5656
valueFrom:
5757
fieldRef:
5858
fieldPath: metadata.namespace
59-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
59+
{{- if (include "fluss.security.jaas.required" .) }}
6060
- name: FLUSS_ENV_JAVA_OPTS
6161
value: "-Djava.security.auth.login.config=/etc/fluss/conf/jaas.conf"
6262
{{- end }}
@@ -102,7 +102,7 @@ spec:
102102
mountPath: /opt/conf
103103
- name: data
104104
mountPath: /tmp/fluss/data
105-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
105+
{{- if (include "fluss.security.jaas.required" .) }}
106106
- name: sasl-config
107107
mountPath: /etc/fluss/conf
108108
readOnly: true
@@ -115,10 +115,10 @@ spec:
115115
- name: data
116116
emptyDir: {}
117117
{{- end }}
118-
{{- if (include "fluss.security.sasl.plain.enabled" .) }}
118+
{{- if (include "fluss.security.jaas.required" .) }}
119119
- name: sasl-config
120120
secret:
121-
secretName: {{ include "fluss.security.sasl.configName" . }}
121+
secretName: {{ include "fluss.security.jaas.configName" . }}
122122
{{- end }}
123123
{{- if .Values.tablet.storage.enabled }}
124124
volumeClaimTemplates:

0 commit comments

Comments
 (0)