Skip to content

RANGER-5148: Fix redundant role cache modify triggered by role versio… #538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mneethiraj merged 6 commits into from
Jan 12, 2026
Merged

RANGER-5148: Fix redundant role cache modify triggered by role versio… #538

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
160d271
RANGER-5148: Fix redundant role cache modify triggered by role versio…
Feb 19, 2025
7203af9
RANGER-5148: Fix redundant role cache modify triggered by role versio…
Mar 2, 2025
125800b
Update RangerRoleCache.java
mneethiraj Jan 12, 2026
b74dbc4
Update RangerRoleCache.java
mneethiraj Jan 12, 2026
de36b1a
removed blank line
mneethiraj Jan 12, 2026
f937480
fix indentation issues
mneethiraj Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 47 additions & 40 deletions security-admin/src/main/java/org/apache/ranger/common/RangerRoleCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ public class RangerRoleCache {
private final int waitTimeInSeconds;
private final ReentrantLock lock = new ReentrantLock();

RangerRoleCacheWrapper roleCacheWrapper;
private final RangerRoleCacheWrapper roleCacheWrapper = new RangerRoleCacheWrapper();

private RangerRoleCache() {
RangerAdminConfig config = RangerAdminConfig.getInstance();
Expand All @@ -69,21 +69,45 @@ public static RangerRoleCache getInstance() {
}

public RangerRoles getLatestRangerRoleOrCached(String serviceName, RoleDBStore roleDBStore, Long lastKnownRoleVersion, Long rangerRoleVersionInDB) throws Exception {
final RangerRoles ret;
RangerRoles ret = null;

if (lastKnownRoleVersion == null || !lastKnownRoleVersion.equals(rangerRoleVersionInDB)) {
roleCacheWrapper = new RangerRoleCacheWrapper();
ret = roleCacheWrapper.getLatestRangerRoles(serviceName, roleDBStore, lastKnownRoleVersion, rangerRoleVersionInDB);
} else {
ret = null;
ret = roleCacheWrapper.getRoles();

if (roleCacheWrapper.getRolesVersion() < rangerRoleVersionInDB) {
boolean lockResult = false;

try {
lockResult = lock.tryLock(waitTimeInSeconds, TimeUnit.SECONDS);

if (lockResult) {
if (roleCacheWrapper.getRolesVersion() < rangerRoleVersionInDB) {
ret = roleCacheWrapper.getLatestRangerRoles(serviceName, roleDBStore, lastKnownRoleVersion, rangerRoleVersionInDB);
} else {
ret = roleCacheWrapper.getRoles();
}
} else {
ret = roleCacheWrapper.getRoles();

LOG.error("Could not get lock in [{}] seconds, returning cached RangerRoles and wait Queue Length:[{}], roles version:[{}]", waitTimeInSeconds, lock.getQueueLength(), (ret != null ? ret.getRoleVersion() : -1L));
}
} catch (InterruptedException exception) {
Thread.currentThread().interrupt();
LOG.error("RangerRoleCache.getLatestRangerRoles:lock got interrupted..", exception);
} finally {
if (lockResult) {
lock.unlock();
}
}
}
}

return ret;
}

private class RangerRoleCacheWrapper {
RangerRoles roles;
Long rolesVersion;
volatile RangerRoles roles;
volatile Long rolesVersion;

RangerRoleCacheWrapper() {
this.roles = null;
Expand All @@ -100,45 +124,28 @@ public Long getRolesVersion() {

public RangerRoles getLatestRangerRoles(String serviceName, RoleDBStore roleDBStore, Long lastKnownRoleVersion, Long rolesVersionInDB) throws Exception {
RangerRoles ret = null;
boolean lockResult = false;

LOG.debug("==> RangerRoleCache.getLatestRangerRoles(ServiceName= {} lastKnownRoleVersion= {} rolesVersionInDB= {})", serviceName, lastKnownRoleVersion, rolesVersionInDB);

try {
lockResult = lock.tryLock(waitTimeInSeconds, TimeUnit.SECONDS);
// We are getting all the Roles to be downloaded for now. Should do downloades for each service based on what roles are there in the policies.
final long startTimeMs = System.currentTimeMillis();
SearchFilter searchFilter = null;
final Set<RangerRole> rolesInDB = new HashSet<>(roleDBStore.getRoles(searchFilter));
final long dbLoadTimeMs = System.currentTimeMillis() - startTimeMs;
Date updateTime = new Date();

if (lockResult) {
// We are getting all the Roles to be downloaded for now. Should do downloades for each service based on what roles are there in the policies.
final long startTimeMs = System.currentTimeMillis();
SearchFilter searchFilter = null;
final Set<RangerRole> rolesInDB = new HashSet<>(roleDBStore.getRoles(searchFilter));
final long dbLoadTimeMs = System.currentTimeMillis() - startTimeMs;
Date updateTime = new Date();

if (LOG.isDebugEnabled()) {
LOG.debug("loading Roles from database and it took:{} seconds", TimeUnit.MILLISECONDS.toSeconds(dbLoadTimeMs));
}

ret = new RangerRoles();
if (LOG.isDebugEnabled()) {
LOG.debug("loading Roles from database and it took:{} seconds", TimeUnit.MILLISECONDS.toSeconds(dbLoadTimeMs));
}

ret.setRangerRoles(rolesInDB);
ret.setRoleUpdateTime(updateTime);
ret.setRoleVersion(rolesVersionInDB);
ret = new RangerRoles();

rolesVersion = rolesVersionInDB;
roles = ret;
} else {
LOG.debug("Could not get lock in [{}] seconds, returning cached RangerRoles", waitTimeInSeconds);
ret.setRangerRoles(rolesInDB);
ret.setRoleUpdateTime(updateTime);
ret.setRoleVersion(rolesVersionInDB);

ret = getRoles();
}
} catch (InterruptedException exception) {
LOG.error("RangerRoleCache.getLatestRangerRoles:lock got interrupted..", exception);
} finally {
if (lockResult) {
lock.unlock();
}
}
roles = ret;
rolesVersion = rolesVersionInDB;

LOG.debug("<== RangerRoleCache.getLatestRangerRoles(ServiceName= {} lastKnownRoleVersion= {} rolesVersionInDB= {} RangerRoles= {})", serviceName, lastKnownRoleVersion, rolesVersionInDB, ret);

Expand Down
Loading