dremio NamespaceService 简单说明一

此处主要说明社区版dremio namspaceservice 包含的一个能力，我们如果自己扩展下就可以实现简单的部分权限管理

参加定义类图

如下如可以看出namspaceservice 提供的能力

 

 

一个额外的能力

  • 接口定义
 
  interface Factory {
    /**
     * Return a namespace service for a given user. Note that this is for usernames
     * and users only, if roles are to be supported, use #get(NamespaceIdentity) instead.
     *
     * @param userName a valid user name
     * @return a namespace service instance
     * @throws NullPointerException if {@code userName} is null
     * @throws IllegalArgumentException if {@code userName} is invalid
     */
    NamespaceService get(String userName);
   //  如果我们希望包含基于角色的控制就可以实现此，实际上就是属于用户的namespace，这样就可以控制用户能力的显示了，可以任务是一个namespace 的子集
    NamespaceService get(NamespaceIdentity identity);
  }

官方的实现

因为默认我们使用的社区版是不启动权限能力的，所以实现比较简单，每个用户获取的都是所有的

NamespaceService 权限部分的使用

实际上是通过查询上下文解决的，主要在CatalogImpl中,基于NamespaceService 创建属于用户的Namespace服务

 CatalogImpl(
      MetadataRequestOptions options,
      PluginRetriever pluginRetriever,
      CatalogServiceImpl.SourceModifier sourceModifier,
      OptionManager optionManager,
      NamespaceService systemNamespaceService,
      NamespaceService.Factory namespaceFactory,
      Orphanage orphanage,
      DatasetListingService datasetListingService,
      ViewCreatorFactory viewCreatorFactory,
      IdentityResolver identityResolver,
      VersionContextResolverImpl versionContextResolverImpl) {
    this.options = options;
    this.pluginRetriever = pluginRetriever;
    this.sourceModifier = sourceModifier;
    this.userName = options.getSchemaConfig().getUserName();
 
    this.optionManager = optionManager;
    this.systemNamespaceService = systemNamespaceService;
    this.namespaceFactory = namespaceFactory;
    this.orphanage = orphanage;
    this.datasetListingService = datasetListingService;
    this.viewCreatorFactory = viewCreatorFactory;
    this.identityResolver = identityResolver;
 
    final CatalogIdentity identity = options.getSchemaConfig().getAuthContext().getSubject();
    // 用户的Namespace服务
    this.userNamespaceService = namespaceFactory.get(identityResolver.toNamespaceIdentity(identity));
 
    this.versionContextResolverImpl = versionContextResolverImpl;
    this.datasets = new DatasetManager(pluginRetriever, userNamespaceService, optionManager, userName,
        identityResolver, versionContextResolverImpl);
    this.iscDelegate = new InformationSchemaCatalogImpl(userNamespaceService, pluginRetriever);
 
    this.selectedSources = ConcurrentHashMap.newKeySet();
    this.crossSourceSelectDisable = optionManager.getOption(CatalogOptions.DISABLE_CROSS_SOURCE_SELECT);
  }

identityResolver.toNamespaceIdentity解析处理

private class CatalogIdentityResolver implements IdentityResolver {
    @Override
    public CatalogIdentity getOwner(List<String> path) throws NamespaceException {
      NamespaceKey key = new NamespaceKey(path);
      if (systemNamespace.getEntityByPath(key).getType() == NameSpaceContainer.Type.DATASET) {
        final DatasetConfig dataset = systemNamespace.getDataset(key);
        return dataset.getType() != DatasetType.VIRTUAL_DATASET ? null : new CatalogUser(dataset.getOwner());
      }
      return null;
    }
 
    @Override
    public NamespaceIdentity toNamespaceIdentity(CatalogIdentity identity) {
      if (identity instanceof CatalogUser) {
        if (identity.getName().equals(SystemUser.SYSTEM_USERNAME)) {
          return new NamespaceUser(() -> SystemUser.SYSTEM_USER);
        }
 
        try {
          final User user = context.get().getUserService().getUser(identity.getName());
          return new NamespaceUser(() -> user);
        } catch (UserNotFoundException ignored) {
        }
      }
 
      return null;
    }
  }

dremio 社区版实现的NamespaceService

从以下可以看出，实际上是没有控制的，所以都是全部数据

 public static final class Factory implements NamespaceService.Factory {
    private final LegacyKVStoreProvider kvStoreProvider;
 
    @Inject
    public Factory(LegacyKVStoreProvider kvStoreProvider) {
      this.kvStoreProvider = kvStoreProvider;
    }
 
    @Override
    public NamespaceService get(String userName) {
      Preconditions.checkNotNull(userName, "requires userName"); // per method contract
      return new NamespaceServiceImpl(kvStoreProvider);
    }
 
    @Override
    public NamespaceService get(NamespaceIdentity identity) {
      Preconditions.checkNotNull(identity, "requires identity"); // per method contract
      return new NamespaceServiceImpl(kvStoreProvider);
    }
  }

说明

以上是一个简单的介绍，大家可以自己扩展下，实现一个简单的权限能力

参考资料

services/namespace/src/main/java/com/dremio/service/namespace/NamespaceService.java
services/namespace/src/main/java/com/dremio/service/namespace/NamespaceServiceImpl.java
sabot/kernel/src/main/java/com/dremio/exec/catalog/CatalogImpl.java

posted on 2023-01-02 22:18  荣锋亮  阅读(37)  评论(0)  编辑  收藏  举报

导航