executor: fix show grants failed after drop granted role#29494
executor: fix show grants failed after drop granted role#29494ti-chi-bot merged 7 commits intopingcap:masterfrom
Conversation
Signed-off-by: unconsolable <chenzhipeng2012@gmail.com>
|
[REVIEW NOTIFICATION] This pull request has been approved by:
To complete the pull request process, please ask the reviewers in the list to review by filling The full list of commands accepted by this bot can be found here. DetailsReviewer can indicate their review by submitting an approval review. |
|
/cc @morgo |
Signed-off-by: unconsolable <chenzhipeng2012@gmail.com>
| if s.IsDropRole { | ||
| for i := 0; i < len(activeRoles); i++ { | ||
| if activeRoles[i].Username == user.Username && activeRoles[i].Hostname == user.Hostname { | ||
| activeRoles = append(activeRoles[:i], activeRoles[i+1:]...) |
There was a problem hiding this comment.
Is the activeRoles information propagated to other TiDB instance?
If not, when you drop the role in one TiDB instance and query in another TiDB instance, the error remains there.
There was a problem hiding this comment.
It is a problem, but I don't know how to solve it... I read through (*SimpleExec).setRoleRegular and can't find related logic.🤔
There was a problem hiding this comment.
./executor/simple.go: return domain.GetDomain(e.ctx).NotifyUpdatePrivilege()
I'm not sure whether this works. E.g, update the privilege cache to make every TiDB instance reload the active role info when drop user is called.
There was a problem hiding this comment.
I found it hard to do so. In Domain I can't find a way to get the related session, thus I don't know how to get the activeRoles. If we can get it, I think we can check and apply activeRoles in (*Handle).Update().
|
/run-integration-test |
|
/run-integration-tests |
morgo
left a comment
There was a problem hiding this comment.
LGTM
I think the integration test errors are unrelated.
|
/merge |
|
This pull request has been accepted and is ready to merge. DetailsCommit hash: bd3a05f |
|
@morgo Shall we keep the issue open to show that it is not fully resolved? |
I think we can say this issue is resolved but fork and create another issue. The privilege cache is also automatically re-generated every 5 minutes, so on a live cluster it will eventually resolve itself. Here is a similar case I fixed recently: #27958 -- so there might be other cases as well. |
|
@unconsolable: Your PR was out of date, I have automatically updated it for you. At the same time I will also trigger all tests for you: /run-all-tests If the CI test fails, you just re-trigger the test that failed and the bot will merge the PR for you after the CI passes. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository. |
Signed-off-by: unconsolable chenzhipeng2012@gmail.com
What problem does this PR solve?
Issue Number: close #29473 #27930
Problem Summary:
What is changed and how it works?
DROP ROLE, remove the role to be dropped fromactiveRolesCheck List
Tests
Side effects
Documentation
Release note