Skip to content

HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests#10873

Open
shuan1026 wants to merge 1 commit into
apache:masterfrom
shuan1026:HDDS-15913
Open

HDDS-15913. Extract common Kerberos/MiniKDC setup from serveral tests#10873
shuan1026 wants to merge 1 commit into
apache:masterfrom
shuan1026:HDDS-15913

Conversation

@shuan1026

Copy link
Copy Markdown

What changes were proposed in this pull request?

Currently, TestSecretKeySnapshot, TestSecretKeysApi, TestDelegationToken, and TestSecureOzoneCluster are independent integration test classes testing SecretKey functionalities in a secure cluster environment. However, they share a significant amount of duplicated boilerplate for setting up the secure environment.

This PR extracts the duplicated Kerberos and MiniKDC initialization logic into a shared abstract base class, AbstractKerberosTest (org.apache.hadoop.ozone), and migrates all four test classes to extend it. To ensure behavior remains identical to before the migration, the base owns the MiniKdc lifecycle (startMiniKdc/stopMiniKdc), setSecureConfig(), and createCredentialsInKDC(), exposing four protected hooks so subclasses can describe how their setup differs instead of duplicating the whole thing:

  • useSharedServicePrincipal() — SCM/OM share one scm/... principal+keytab (TestSecretKeysApi, TestSecretKeySnapshot) vs. separate scm/... / om/... principals (TestDelegationToken, TestSecureOzoneCluster)
  • createTestUserPrincipal() — whether a test@REALM principal is created
  • enableSecurityAuthorizationByDefault() — whether hadoop.security.authorization defaults to true
  • kerberosAuthenticationValue() — preserves a pre-existing inconsistency where two classes set hadoop.security.authentication to the literal lowercase "kerberos" instead of the enum's "KERBEROS"

The trickiest part was TestSecureOzoneCluster: it sets up the KDC once per class (@BeforeAll/@AfterAll, static fields), while the other three do it fresh per test method. JUnit 5's @TempDir on an instance field is scoped per-test-method regardless of @TestInstance lifecycle, so the base class's workDir was changed from a JUnit-managed @TempDir field to a manually created and cleaned directory using Files.createTempDirectory and FileUtils.deleteQuietly, both already-established patterns elsewhere in this test module. This lets TestSecureOzoneCluster use @TestInstance(Lifecycle.PER_CLASS) with instance-level @BeforeAll/@AfterAll while the other three keep their existing per-test behavior unchanged. Under JUnit Jupiter's default PER_METHOD lifecycle, each test method runs on a fresh instance of the test class, so workDir is null again each time.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-15913

How was this patch tested?

  • Ran mvn -pl :ozone-integration-test test-compile; compile succeeded.
  • Ran mvn -pl :ozone-integration-test test -Dtest=TestSecretKeysApi,TestSecretKeySnapshot,TestDelegationToken,TestSecureOzoneCluster; all 4 classes passed.
  • Ran ./hadoop-ozone/dev-support/checks/checkstyle.sh; no violations.

@shuan1026

Copy link
Copy Markdown
Author

PTAL @chungen0126 Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant