big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-18397. Shutdown AWSSecurityTokenService when its resources are no longer in use (#4722)

Browse Source 
Contributed by Viraj Jasani.
This commit is contained in:
Viraj Jasani 2022-08-12 03:59:15 -07:00 committed by Steve Loughran
parent 93c4704b33
commit 6b7c1329b2
No known key found for this signature in database
GPG Key ID: D22CF846DBB162A0
3 changed files with 24 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/MarshalledCredentialBinding.java
View File

@ -207,9 +207,11 @@ public static MarshalledCredentials requestSessionCredentials(
stsEndpoint.isEmpty() ? null : stsEndpoint,
stsRegion)
.build();
return fromSTSCredentials(
STSClientFactory.createClientConnection(tokenService, invoker)
.requestSessionCredentials(duration, TimeUnit.SECONDS));
try (STSClientFactory.STSClient stsClient = STSClientFactory.createClientConnection(
tokenService, invoker)) {
return fromSTSCredentials(stsClient.requestSessionCredentials(duration,
TimeUnit.SECONDS));
}
} catch (SdkClientException e) {
if (stsRegion.isEmpty()) {
LOG.error("Region must be provided when requesting session credentials.",

11
hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/STSClientFactory.java
View File

@ -149,12 +149,10 @@ public static AWSSecurityTokenServiceClientBuilder builder(
* @param tokenService STS instance
* @param invoker invoker to use
* @return an STS client bonded to that interface.
* @throws IOException on any failure
*/
public static STSClient createClientConnection(
final AWSSecurityTokenService tokenService,
final Invoker invoker)
throws IOException {
final Invoker invoker) {
return new STSClient(tokenService, invoker);
}
@ -175,12 +173,9 @@ private STSClient(final AWSSecurityTokenService tokenService,
@Override
public void close() throws IOException {
try {
// Since we are not using AbstractAWSSecurityTokenService, we
// don't need to worry about catching UnsupportedOperationException.
tokenService.shutdown();
} catch (UnsupportedOperationException ignored) {
// ignore this, as it is what the STS client currently
// does.
}
}
/**

27
hadoop-tools/hadoop-aws/src/test/java/org/apache/hadoop/fs/s3a/ITestS3ATemporaryCredentials.java
View File

@ -125,13 +125,14 @@ public void testSTS() throws IOException {
credentials,
getStsEndpoint(conf),
getStsRegion(conf));
STSClientFactory.STSClient clientConnection =
STSClientFactory.createClientConnection(
builder.build(),
new Invoker(new S3ARetryPolicy(conf), Invoker.LOG_EVENT));
Credentials sessionCreds = clientConnection
.requestSessionCredentials(TEST_SESSION_TOKEN_DURATION_SECONDS,
TimeUnit.SECONDS);
Credentials sessionCreds;
try (STSClientFactory.STSClient clientConnection =
STSClientFactory.createClientConnection(builder.build(),
new Invoker(new S3ARetryPolicy(conf), Invoker.LOG_EVENT))) {
sessionCreds = clientConnection
.requestSessionCredentials(
TEST_SESSION_TOKEN_DURATION_SECONDS, TimeUnit.SECONDS);
}
// clone configuration so changes here do not affect the base FS.
Configuration conf2 = new Configuration(conf);
@ -379,11 +380,12 @@ public <E extends Exception> E expectedSessionRequestFailure(
Invoker invoker = new Invoker(new S3ARetryPolicy(conf),
LOG_AT_ERROR);
STSClientFactory.STSClient stsClient
= STSClientFactory.createClientConnection(tokenService,
invoker);
return stsClient.requestSessionCredentials(30, TimeUnit.MINUTES);
try (STSClientFactory.STSClient stsClient =
STSClientFactory.createClientConnection(
tokenService, invoker)) {
return stsClient.requestSessionCredentials(
30, TimeUnit.MINUTES);
}
});
}
}
@ -413,6 +415,7 @@ public void testTemporaryCredentialValidationOnLoad() throws Throwable {
return sc.toString();
});
}
@Test
public void testEmptyTemporaryCredentialValidation() throws Throwable {
Configuration conf = new Configuration();