rust/greptimedb
1
0
Fork 0
mirror of https://github.com/GreptimeTeam/greptimedb.git synced 2026-09-08 14:39:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(frontend): degrade descriptor permission denial to a warning

Browse Source 
A table-level permission policy denying otel_resource_info would have
failed the whole OTLP metrics request because the descriptor's
permission check ran before the main insert. The descriptor is derived
enrichment: check its permission in the degrade path so a denial skips
the write and surfaces as the partial-success warning, like any other
descriptor write failure.

Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
This commit is contained in:
Dennis Zhuang
2026-08-17 22:58:32 +08:00
parent 9e2bf8781a
commit 2401b3dd9c
1 changed files with 26 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/frontend/src/instance/otlp.rs
+26 -24
View File
@@ -128,14 +128,6 @@ impl OpenTelemetryProtocolHandler for Instance {
} = otlp::metrics::to_grpc_insert_requests(request, &mut metric_ctx)?; } = otlp::metrics::to_grpc_insert_requests(request, &mut metric_ctx)?;
self.check_row_insert_permission(&requests, &ctx, PermissionReq::Action(OTLP_WRITE)) self.check_row_insert_permission(&requests, &ctx, PermissionReq::Action(OTLP_WRITE))
.context(AuthSnafu)?; .context(AuthSnafu)?;
if let Some(resource_info) = &resource_info {
self.check_row_insert_permission(
resource_info,
&ctx,
PermissionReq::Action(OTLP_WRITE),
)
.context(AuthSnafu)?;
}
self.cache_otlp_legacy(&input_names, &ctx, is_legacy)?; self.cache_otlp_legacy(&input_names, &ctx, is_legacy)?;
OTLP_METRICS_ROWS.inc_by(rows as u64); OTLP_METRICS_ROWS.inc_by(rows as u64);
@@ -173,23 +165,33 @@ impl OpenTelemetryProtocolHandler for Instance {
}; };
// The descriptor is derived enrichment written after the main data is // The descriptor is derived enrichment written after the main data is
// committed: a failure here (e.g. a conflicting pre-existing table, or // committed: neither a permission denial on its table nor a write
// auto-create disabled) must not fail the request and trigger client // failure (e.g. a conflicting pre-existing table, or auto-create
// retries of already-accepted data; it degrades to a partial-success // disabled) must fail the request and trigger client retries of
// warning. // already-accepted data; both degrade to a partial-success warning.
let mut warning = None; let mut warning = None;
if let Some(resource_info) = resource_info if let Some(resource_info) = resource_info {
&& let Err(e) = self let written = match self.check_row_insert_permission(
.handle_row_inserts(resource_info, ctx, false, false) &resource_info,
.await &ctx,
{ PermissionReq::Action(OTLP_WRITE),
OTLP_RESOURCE_INFO_WRITE_ERRORS.inc(); ) {
common_telemetry::warn!(e; "Failed to write the OTLP resource descriptor table"); Ok(_) => self
warning = Some(format!( .handle_row_inserts(resource_info, ctx, false, false)
"metric data was accepted, but writing the resource \ .await
descriptor table `{}` failed: {e}", .map(|_| ())
otlp::metrics::OTEL_RESOURCE_INFO_TABLE_NAME .map_err(BoxedError::new),
)); Err(e) => Err(BoxedError::new(e)),
};
if let Err(e) = written {
OTLP_RESOURCE_INFO_WRITE_ERRORS.inc();
common_telemetry::warn!(e; "Failed to write the OTLP resource descriptor table");
warning = Some(format!(
"metric data was accepted, but writing the resource \
descriptor table `{}` failed: {e}",
otlp::metrics::OTEL_RESOURCE_INFO_TABLE_NAME
));
}
} }
Ok(OtlpMetricsOutcome { output, warning }) Ok(OtlpMetricsOutcome { output, warning })