8cde3d4486
* Add iceberg_maintenance plugin worker handler (Phase 1) Implement automated Iceberg table maintenance as a new plugin worker job type. The handler scans S3 table buckets for tables needing maintenance and executes operations in the correct Iceberg order: expire snapshots, remove orphan files, and rewrite manifests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add data file compaction to iceberg maintenance handler (Phase 2) Implement bin-packing compaction for small Parquet data files: - Enumerate data files from manifests, group by partition - Merge small files using parquet-go (read rows, write merged output) - Create new manifest with ADDED/DELETED/EXISTING entries - Commit new snapshot with compaction metadata Add 'compact' operation to maintenance order (runs before expire_snapshots), configurable via target_file_size_bytes and min_input_files thresholds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix memory exhaustion in mergeParquetFiles by processing files sequentially Previously all source Parquet files were loaded into memory simultaneously, risking OOM when a compaction bin contained many small files. Now each file is loaded, its rows are streamed into the output writer, and its data is released before the next file is loaded — keeping peak memory proportional to one input file plus the output buffer. * Validate bucket/namespace/table names against path traversal Reject names containing '..', '/', or '\' in Execute to prevent directory traversal via crafted job parameters. * Add filer address failover in iceberg maintenance handler Try each filer address from cluster context in order instead of only using the first one. This improves resilience when the primary filer is temporarily unreachable. * Add separate MinManifestsToRewrite config for manifest rewrite threshold The rewrite_manifests operation was reusing MinInputFiles (meant for compaction bin file counts) as its manifest count threshold. Add a dedicated MinManifestsToRewrite field with its own config UI section and default value (5) so the two thresholds can be tuned independently. * Fix risky mtime fallback in orphan removal that could delete new files When entry.Attributes is nil, mtime defaulted to Unix epoch (1970), which would always be older than the safety threshold, causing the file to be treated as eligible for deletion. Skip entries with nil Attributes instead, matching the safer logic in operations.go. * Fix undefined function references in iceberg_maintenance_handler.go Use the exported function names (ShouldSkipDetectionByInterval, BuildDetectorActivity, BuildExecutorActivity) matching their definitions in vacuum_handler.go. * Remove duplicated iceberg maintenance handler in favor of iceberg/ subpackage The IcebergMaintenanceHandler and its compaction code in the parent pluginworker package duplicated the logic already present in the iceberg/ subpackage (which self-registers via init()). The old code lacked stale-plan guards, proper path normalization, CAS-based xattr updates, and error-returning parseOperations. Since the registry pattern (default "all") makes the old handler unreachable, remove it entirely. All functionality is provided by iceberg.Handler with the reviewed improvements. * Fix MinManifestsToRewrite clamping to match UI minimum of 2 The clamp reset values below 2 to the default of 5, contradicting the UI's advertised MinValue of 2. Clamp to 2 instead. * Sort entries by size descending in splitOversizedBin for better packing Entries were processed in insertion order which is non-deterministic from map iteration. Sorting largest-first before the splitting loop improves bin packing efficiency by filling bins more evenly. * Add context cancellation check to drainReader loop The row-streaming loop in drainReader did not check ctx between iterations, making long compaction merges uncancellable. Check ctx.Done() at the top of each iteration. * Fix splitOversizedBin to always respect targetSize limit The minFiles check in the split condition allowed bins to grow past targetSize when they had fewer than minFiles entries, defeating the OOM protection. Now bins always split at targetSize, and a trailing runt with fewer than minFiles entries is merged into the previous bin. * Add integration tests for iceberg table maintenance plugin worker Tests start a real weed mini cluster, create S3 buckets and Iceberg table metadata via filer gRPC, then exercise the iceberg.Handler operations (ExpireSnapshots, RemoveOrphans, RewriteManifests) against the live filer. A full maintenance cycle test runs all operations in sequence and verifies metadata consistency. Also adds exported method wrappers (testing_api.go) so the integration test package can call the unexported handler methods. * Fix splitOversizedBin dropping files and add source path to drainReader errors The runt-merge step could leave leading bins with fewer than minFiles entries (e.g. [80,80,10,10] with targetSize=100, minFiles=2 would drop the first 80-byte file). Replace the filter-based approach with an iterative merge that folds any sub-minFiles bin into its smallest neighbor, preserving all eligible files. Also add the source file path to drainReader error messages so callers can identify which Parquet file caused a read/write failure. * Harden integration test error handling - s3put: fail immediately on HTTP 4xx/5xx instead of logging and continuing - lookupEntry: distinguish NotFound (return nil) from unexpected RPC errors (fail the test) - writeOrphan and orphan creation in FullMaintenanceCycle: check CreateEntryResponse.Error in addition to the RPC error * go fmt --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
86 lines
3.3 KiB
Go
86 lines
3.3 KiB
Go
package s3_constants
|
|
|
|
// S3 action strings for bucket policy evaluation
|
|
// These match the official AWS S3 action format used in IAM and bucket policies
|
|
const (
|
|
// Object operations
|
|
S3_ACTION_GET_OBJECT = "s3:GetObject"
|
|
S3_ACTION_PUT_OBJECT = "s3:PutObject"
|
|
S3_ACTION_DELETE_OBJECT = "s3:DeleteObject"
|
|
S3_ACTION_DELETE_OBJECT_VERSION = "s3:DeleteObjectVersion"
|
|
S3_ACTION_GET_OBJECT_VERSION = "s3:GetObjectVersion"
|
|
S3_ACTION_GET_OBJECT_ATTRIBUTES = "s3:GetObjectAttributes"
|
|
|
|
// Object ACL operations
|
|
S3_ACTION_GET_OBJECT_ACL = "s3:GetObjectAcl"
|
|
S3_ACTION_PUT_OBJECT_ACL = "s3:PutObjectAcl"
|
|
|
|
// Object tagging operations
|
|
S3_ACTION_GET_OBJECT_TAGGING = "s3:GetObjectTagging"
|
|
S3_ACTION_PUT_OBJECT_TAGGING = "s3:PutObjectTagging"
|
|
S3_ACTION_DELETE_OBJECT_TAGGING = "s3:DeleteObjectTagging"
|
|
|
|
// Object retention and legal hold
|
|
S3_ACTION_GET_OBJECT_RETENTION = "s3:GetObjectRetention"
|
|
S3_ACTION_PUT_OBJECT_RETENTION = "s3:PutObjectRetention"
|
|
S3_ACTION_GET_OBJECT_LEGAL_HOLD = "s3:GetObjectLegalHold"
|
|
S3_ACTION_PUT_OBJECT_LEGAL_HOLD = "s3:PutObjectLegalHold"
|
|
S3_ACTION_BYPASS_GOVERNANCE = "s3:BypassGovernanceRetention"
|
|
|
|
// Multipart upload operations
|
|
S3_ACTION_CREATE_MULTIPART = "s3:CreateMultipartUpload"
|
|
S3_ACTION_UPLOAD_PART = "s3:UploadPart"
|
|
S3_ACTION_COMPLETE_MULTIPART = "s3:CompleteMultipartUpload"
|
|
S3_ACTION_ABORT_MULTIPART = "s3:AbortMultipartUpload"
|
|
S3_ACTION_LIST_PARTS = "s3:ListMultipartUploadParts"
|
|
S3_ACTION_LIST_MULTIPART_UPLOADS = "s3:ListBucketMultipartUploads"
|
|
|
|
// Bucket operations
|
|
S3_ACTION_CREATE_BUCKET = "s3:CreateBucket"
|
|
S3_ACTION_DELETE_BUCKET = "s3:DeleteBucket"
|
|
S3_ACTION_LIST_BUCKET = "s3:ListBucket"
|
|
S3_ACTION_LIST_BUCKET_VERSIONS = "s3:ListBucketVersions"
|
|
|
|
// Bucket ACL operations
|
|
S3_ACTION_GET_BUCKET_ACL = "s3:GetBucketAcl"
|
|
S3_ACTION_PUT_BUCKET_ACL = "s3:PutBucketAcl"
|
|
|
|
// Bucket policy operations
|
|
S3_ACTION_GET_BUCKET_POLICY = "s3:GetBucketPolicy"
|
|
S3_ACTION_PUT_BUCKET_POLICY = "s3:PutBucketPolicy"
|
|
S3_ACTION_DELETE_BUCKET_POLICY = "s3:DeleteBucketPolicy"
|
|
|
|
// Bucket tagging operations
|
|
S3_ACTION_GET_BUCKET_TAGGING = "s3:GetBucketTagging"
|
|
S3_ACTION_PUT_BUCKET_TAGGING = "s3:PutBucketTagging"
|
|
S3_ACTION_DELETE_BUCKET_TAGGING = "s3:DeleteBucketTagging"
|
|
|
|
// Bucket CORS operations
|
|
S3_ACTION_GET_BUCKET_CORS = "s3:GetBucketCors"
|
|
S3_ACTION_PUT_BUCKET_CORS = "s3:PutBucketCors"
|
|
S3_ACTION_DELETE_BUCKET_CORS = "s3:DeleteBucketCors"
|
|
|
|
// Bucket lifecycle operations
|
|
// Note: Both PUT and DELETE lifecycle operations use s3:PutLifecycleConfiguration
|
|
S3_ACTION_GET_BUCKET_LIFECYCLE = "s3:GetLifecycleConfiguration"
|
|
S3_ACTION_PUT_BUCKET_LIFECYCLE = "s3:PutLifecycleConfiguration"
|
|
|
|
// Bucket versioning operations
|
|
S3_ACTION_GET_BUCKET_VERSIONING = "s3:GetBucketVersioning"
|
|
S3_ACTION_PUT_BUCKET_VERSIONING = "s3:PutBucketVersioning"
|
|
|
|
// Bucket location
|
|
S3_ACTION_GET_BUCKET_LOCATION = "s3:GetBucketLocation"
|
|
|
|
// Bucket notification
|
|
S3_ACTION_GET_BUCKET_NOTIFICATION = "s3:GetBucketNotification"
|
|
S3_ACTION_PUT_BUCKET_NOTIFICATION = "s3:PutBucketNotification"
|
|
|
|
// Bucket object lock operations
|
|
S3_ACTION_GET_BUCKET_OBJECT_LOCK = "s3:GetBucketObjectLockConfiguration"
|
|
S3_ACTION_PUT_BUCKET_OBJECT_LOCK = "s3:PutBucketObjectLockConfiguration"
|
|
|
|
// Wildcard for all S3 actions
|
|
S3_ACTION_ALL = "s3:*"
|
|
)
|