diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index a655b89cb2..6c4d57d687 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -74,6 +74,7 @@ jakarta-validation-api = { module = "jakarta.validation:jakarta.validation-api", jakarta-ws-rs-api = { module = "jakarta.ws.rs:jakarta.ws.rs-api", version = "4.0.0" } javax-servlet-api = { module = "javax.servlet:javax.servlet-api", version = "4.0.1" } junit-bom = { module = "org.junit:junit-bom", version = "5.13.4" } +localstack = { module = "org.testcontainers:localstack", version = "1.19.7" } keycloak-admin-client = { module = "org.keycloak:keycloak-admin-client", version = "26.0.6" } logback-classic = { module = "ch.qos.logback:logback-classic", version = "1.5.18" } micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.15.3" } diff --git a/runtime/service/build.gradle.kts b/runtime/service/build.gradle.kts index 87e95c5300..031dc54aa9 100644 --- a/runtime/service/build.gradle.kts +++ b/runtime/service/build.gradle.kts @@ -103,6 +103,7 @@ dependencies { implementation("software.amazon.awssdk:sts") implementation("software.amazon.awssdk:iam-policy-builder") implementation("software.amazon.awssdk:s3") + implementation("software.amazon.awssdk:cloudwatchlogs") implementation("software.amazon.awssdk:apache-client") { exclude("commons-logging", "commons-logging") } @@ -144,6 +145,9 @@ dependencies { testImplementation("io.quarkus:quarkus-rest-client") testImplementation("io.quarkus:quarkus-rest-client-jackson") testImplementation("io.rest-assured:rest-assured") + testImplementation(libs.localstack) + testImplementation("org.testcontainers:testcontainers") + testImplementation(project(":polaris-container-spec-helper")) testImplementation(libs.threeten.extra) testImplementation(libs.hawkular.agent.prometheus.scraper) diff --git a/runtime/service/src/main/java/org/apache/polaris/service/events/PolarisEventListenerConfiguration.java b/runtime/service/src/main/java/org/apache/polaris/service/events/PolarisEventListenerConfiguration.java index 9b165ee3a5..8f46f663ba 100644 --- a/runtime/service/src/main/java/org/apache/polaris/service/events/PolarisEventListenerConfiguration.java +++ b/runtime/service/src/main/java/org/apache/polaris/service/events/PolarisEventListenerConfiguration.java @@ -25,8 +25,8 @@ @ConfigMapping(prefix = "polaris.event-listener") public interface PolarisEventListenerConfiguration { /** - * The type of the event listener to use. Must be a registered {@link - * org.apache.polaris.service.events.PolarisEventListener} identifier. + * The type of the event listener to use. Must be a registered {@link PolarisEventListener} + * identifier. */ String type(); } diff --git a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java new file mode 100644 index 0000000000..28db713dbd --- /dev/null +++ b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java @@ -0,0 +1,43 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.polaris.service.events.jsonEventListener; + +import java.util.HashMap; +import org.apache.polaris.service.events.AfterTableRefreshedEvent; +import org.apache.polaris.service.events.PolarisEventListener; + +/** + * This class provides a common framework for transforming Polaris events into a HashMap, which can + * be used to transform the event further, such as transforming into a JSON string, and send them to + * various destinations. Concrete implementations should override the + * {{@code @link#transformAndSendEvent(HashMap)}} method to define how the event data should be + * transformed into a JSON string, transmitted, and/or stored. + */ +public abstract class PropertyMapEventListener extends PolarisEventListener { + protected abstract void transformAndSendEvent(HashMap properties); + + @Override + public void onAfterTableRefreshed(AfterTableRefreshedEvent event) { + HashMap properties = new HashMap<>(); + properties.put("event_type", event.getClass().getSimpleName()); + properties.put("table_identifier", event.tableIdentifier().toString()); + transformAndSendEvent(properties); + } +} diff --git a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java new file mode 100644 index 0000000000..46e07f569d --- /dev/null +++ b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java @@ -0,0 +1,31 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch; + +/** Configuration interface for AWS CloudWatch event listener settings. */ +public interface AwsCloudWatchConfiguration { + String awsCloudWatchLogGroup(); + + String awsCloudWatchLogStream(); + + String awsCloudWatchRegion(); + + boolean synchronousMode(); +} diff --git a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java new file mode 100644 index 0000000000..87cf70a2f1 --- /dev/null +++ b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java @@ -0,0 +1,190 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.ObjectMapper; +import io.smallrye.common.annotation.Identifier; +import jakarta.annotation.PostConstruct; +import jakarta.annotation.PreDestroy; +import jakarta.enterprise.context.ApplicationScoped; +import jakarta.inject.Inject; +import jakarta.ws.rs.core.Context; +import jakarta.ws.rs.core.SecurityContext; +import java.time.Clock; +import java.util.HashMap; +import java.util.List; +import java.util.concurrent.CompletableFuture; +import java.util.function.Supplier; +import org.apache.polaris.core.auth.PolarisPrincipal; +import org.apache.polaris.core.context.CallContext; +import org.apache.polaris.service.config.PolarisIcebergObjectMapperCustomizer; +import org.apache.polaris.service.events.jsonEventListener.PropertyMapEventListener; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import software.amazon.awssdk.regions.Region; +import software.amazon.awssdk.services.cloudwatchlogs.CloudWatchLogsAsyncClient; +import software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogGroupRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogStreamRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.InputLogEvent; +import software.amazon.awssdk.services.cloudwatchlogs.model.PutLogEventsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.PutLogEventsResponse; + +@ApplicationScoped +@Identifier("aws-cloudwatch") +public class AwsCloudWatchEventListener extends PropertyMapEventListener { + private static final Logger LOGGER = LoggerFactory.getLogger(AwsCloudWatchEventListener.class); + final ObjectMapper objectMapper = new ObjectMapper(); + + private CloudWatchLogsAsyncClient client; + + private final String logGroup; + private final String logStream; + private final Region region; + private final boolean synchronousMode; + private final Clock clock; + + @Inject CallContext callContext; + + @Context SecurityContext securityContext; + + @Inject + public AwsCloudWatchEventListener( + AwsCloudWatchConfiguration config, + Clock clock, + PolarisIcebergObjectMapperCustomizer customizer) { + this.logStream = config.awsCloudWatchLogStream(); + this.logGroup = config.awsCloudWatchLogGroup(); + this.region = Region.of(config.awsCloudWatchRegion()); + this.synchronousMode = config.synchronousMode(); + this.clock = clock; + customizer.customize(this.objectMapper); + } + + @PostConstruct + void start() { + this.client = createCloudWatchAsyncClient(); + ensureLogGroupAndStream(); + } + + protected CloudWatchLogsAsyncClient createCloudWatchAsyncClient() { + return CloudWatchLogsAsyncClient.builder().region(region).build(); + } + + private void ensureLogGroupAndStream() { + ensureResourceExists( + () -> + client + .describeLogGroups( + DescribeLogGroupsRequest.builder().logGroupNamePrefix(logGroup).build()) + .join() + .logGroups() + .stream() + .anyMatch(g -> g.logGroupName().equals(logGroup)), + () -> + client + .createLogGroup(CreateLogGroupRequest.builder().logGroupName(logGroup).build()) + .join(), + "group", + logGroup); + ensureResourceExists( + () -> + client + .describeLogStreams( + DescribeLogStreamsRequest.builder() + .logGroupName(logGroup) + .logStreamNamePrefix(logStream) + .build()) + .join() + .logStreams() + .stream() + .anyMatch(s -> s.logStreamName().equals(logStream)), + () -> + client + .createLogStream( + CreateLogStreamRequest.builder() + .logGroupName(logGroup) + .logStreamName(logStream) + .build()) + .join(), + "stream", + logStream); + } + + private static void ensureResourceExists( + Supplier existsCheck, + Runnable createAction, + String resourceType, + String resourceName) { + if (existsCheck.get()) { + LOGGER.debug("Log {} [{}] already exists", resourceType, resourceName); + } else { + LOGGER.debug("Attempting to create log {}: {}", resourceType, resourceName); + createAction.run(); + } + } + + @PreDestroy + void shutdown() { + if (client != null) { + client.close(); + client = null; + } + } + + @Override + protected void transformAndSendEvent(HashMap properties) { + properties.put("realm_id", callContext.getRealmContext().getRealmIdentifier()); + properties.put("principal", securityContext.getUserPrincipal().getName()); + properties.put( + "activated_roles", ((PolarisPrincipal) securityContext.getUserPrincipal()).getRoles()); + // TODO: Add request ID when it is available + String eventAsJson; + try { + eventAsJson = objectMapper.writeValueAsString(properties); + } catch (JsonProcessingException e) { + LOGGER.error("Error processing event into JSON string: ", e); + LOGGER.debug("Failed to convert the following object into JSON string: {}", properties); + return; + } + InputLogEvent inputLogEvent = + InputLogEvent.builder().message(eventAsJson).timestamp(clock.millis()).build(); + PutLogEventsRequest.Builder requestBuilder = + PutLogEventsRequest.builder() + .logGroupName(logGroup) + .logStreamName(logStream) + .logEvents(List.of(inputLogEvent)); + CompletableFuture future = + client + .putLogEvents(requestBuilder.build()) + .whenComplete( + (resp, err) -> { + if (err != null) { + LOGGER.error( + "Error writing log to CloudWatch. Event: {}, Error: ", inputLogEvent, err); + } + }); + if (synchronousMode) { + future.join(); + } + } +} diff --git a/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java b/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java new file mode 100644 index 0000000000..91c32ce063 --- /dev/null +++ b/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java @@ -0,0 +1,99 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.polaris.service.quarkus.events.jsonEventListener.aws.cloudwatch; + +import io.quarkus.runtime.annotations.StaticInitSafe; +import io.smallrye.config.ConfigMapping; +import io.smallrye.config.WithDefault; +import io.smallrye.config.WithName; +import jakarta.enterprise.context.ApplicationScoped; +import org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch.AwsCloudWatchConfiguration; + +/** + * Quarkus-specific configuration interface for AWS CloudWatch event listener integration. + * + *

This interface extends the base {@link AwsCloudWatchConfiguration} and provides + * Quarkus-specific configuration mappings for AWS CloudWatch logging functionality. + */ +@StaticInitSafe +@ConfigMapping(prefix = "polaris.event-listener.aws-cloudwatch") +@ApplicationScoped +public interface QuarkusAwsCloudWatchConfiguration extends AwsCloudWatchConfiguration { + + /** + * Returns the AWS CloudWatch log group name for event logging. + * + *

The log group is a collection of log streams that share the same retention, monitoring, and + * access control settings. If not specified, defaults to "polaris-cloudwatch-default-group". + * + *

Configuration property: {@code polaris.event-listener.aws-cloudwatch.log-group} + * + * @return a String containing the log group name, or the default value if not configured + */ + @WithName("log-group") + @WithDefault("polaris-cloudwatch-default-group") + @Override + String awsCloudWatchLogGroup(); + + /** + * Returns the AWS CloudWatch log stream name for event logging. + * + *

A log stream is a sequence of log events that share the same source. Each log stream belongs + * to one log group. If not specified, defaults to "polaris-cloudwatch-default-stream". + * + *

Configuration property: {@code polaris.event-listener.aws-cloudwatch.log-stream} + * + * @return a String containing the log stream name, or the default value if not configured + */ + @WithName("log-stream") + @WithDefault("polaris-cloudwatch-default-stream") + @Override + String awsCloudWatchLogStream(); + + /** + * Returns the AWS region where CloudWatch logs should be sent. + * + *

This specifies the AWS region for the CloudWatch service endpoint. The region must be a + * valid AWS region identifier. If not specified, defaults to "us-east-1". + * + *

Configuration property: {@code polaris.event-listener.aws-cloudwatch.region} + * + * @return a String containing the AWS region, or the default value if not configured + */ + @WithName("region") + @WithDefault("us-east-1") + @Override + String awsCloudWatchRegion(); + + /** + * Returns the synchronous mode setting for CloudWatch logging. + * + *

When set to "true", log events are sent to CloudWatch synchronously, which may impact + * application performance but ensures immediate delivery. When set to "false" (default), log + * events are sent asynchronously for better performance. + * + *

Configuration property: {@code polaris.event-listener.aws-cloudwatch.synchronous-mode} + * + * @return a boolean value indicating the synchronous mode setting + */ + @WithName("synchronous-mode") + @WithDefault("false") + @Override + boolean synchronousMode(); +} diff --git a/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java b/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java new file mode 100644 index 0000000000..e7225e1568 --- /dev/null +++ b/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java @@ -0,0 +1,346 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch; + +import static org.apache.polaris.containerspec.ContainerSpecHelper.containerSpecHelper; +import static org.assertj.core.api.Assertions.assertThat; +import static org.mockito.Mockito.when; + +import com.fasterxml.jackson.databind.PropertyNamingStrategies; +import io.quarkus.runtime.configuration.MemorySize; +import jakarta.ws.rs.core.SecurityContext; +import java.math.BigInteger; +import java.security.Principal; +import java.time.Clock; +import java.time.Duration; +import java.util.Set; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.concurrent.TimeUnit; +import org.apache.iceberg.catalog.TableIdentifier; +import org.apache.polaris.core.PolarisCallContext; +import org.apache.polaris.core.auth.PolarisPrincipal; +import org.apache.polaris.core.context.CallContext; +import org.apache.polaris.core.context.RealmContext; +import org.apache.polaris.service.config.PolarisIcebergObjectMapperCustomizer; +import org.apache.polaris.service.events.AfterTableRefreshedEvent; +import org.awaitility.Awaitility; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.testcontainers.containers.localstack.LocalStackContainer; +import software.amazon.awssdk.auth.credentials.AwsBasicCredentials; +import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider; +import software.amazon.awssdk.regions.Region; +import software.amazon.awssdk.services.cloudwatchlogs.CloudWatchLogsAsyncClient; +import software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogGroupRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogStreamRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsResponse; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsResponse; +import software.amazon.awssdk.services.cloudwatchlogs.model.GetLogEventsRequest; +import software.amazon.awssdk.services.cloudwatchlogs.model.GetLogEventsResponse; + +class AwsCloudWatchEventListenerTest { + private static final Logger LOGGER = + LoggerFactory.getLogger(AwsCloudWatchEventListenerTest.class); + + private static final LocalStackContainer localStack = + new LocalStackContainer( + containerSpecHelper("localstack", AwsCloudWatchEventListenerTest.class) + .dockerImageName(null)) + .withServices(LocalStackContainer.Service.CLOUDWATCHLOGS); + + private static final String LOG_GROUP = "test-log-group"; + private static final String LOG_STREAM = "test-log-stream"; + private static final String REALM = "test-realm"; + private static final String TEST_USER = "test-user"; + private static final Clock clock = Clock.systemUTC(); + private static final BigInteger MAX_BODY_SIZE = BigInteger.valueOf(1024 * 1024); + private static final PolarisIcebergObjectMapperCustomizer customizer = + new PolarisIcebergObjectMapperCustomizer(new MemorySize(MAX_BODY_SIZE)); + + @Mock private AwsCloudWatchConfiguration config; + + private ExecutorService executorService; + private AutoCloseable mockitoContext; + + @BeforeEach + void setUp() { + mockitoContext = MockitoAnnotations.openMocks(this); + executorService = Executors.newSingleThreadExecutor(); + + // Configure the mocks + when(config.awsCloudWatchLogGroup()).thenReturn(LOG_GROUP); + when(config.awsCloudWatchLogStream()).thenReturn(LOG_STREAM); + when(config.awsCloudWatchRegion()).thenReturn("us-east-1"); + when(config.synchronousMode()).thenReturn(false); // Default to async mode + } + + @AfterEach + void tearDown() throws Exception { + if (mockitoContext != null) { + mockitoContext.close(); + } + if (executorService != null) { + executorService.shutdownNow(); + if (!executorService.awaitTermination(5, TimeUnit.SECONDS)) { + LOGGER.warn("ExecutorService did not terminate in time"); + } + } + if (localStack.isRunning()) { + localStack.stop(); + } + } + + private CloudWatchLogsAsyncClient createCloudWatchAsyncClient() { + if (!localStack.isRunning()) { + localStack.start(); + } + return CloudWatchLogsAsyncClient.builder() + .endpointOverride(localStack.getEndpoint()) + .credentialsProvider( + StaticCredentialsProvider.create( + AwsBasicCredentials.create(localStack.getAccessKey(), localStack.getSecretKey()))) + .region(Region.of(localStack.getRegion())) + .build(); + } + + private AwsCloudWatchEventListener createListener(CloudWatchLogsAsyncClient client) { + AwsCloudWatchEventListener listener = + new AwsCloudWatchEventListener(config, clock, customizer) { + @Override + protected CloudWatchLogsAsyncClient createCloudWatchAsyncClient() { + return client; + } + }; + + // Set up call context and security context + CallContext callContext = Mockito.mock(CallContext.class); + PolarisCallContext polarisCallContext = Mockito.mock(PolarisCallContext.class); + RealmContext realmContext = Mockito.mock(RealmContext.class); + SecurityContext securityContext = Mockito.mock(SecurityContext.class); + Principal principal = Mockito.mock(PolarisPrincipal.class); + when(callContext.getRealmContext()).thenReturn(realmContext); + when(callContext.getPolarisCallContext()).thenReturn(polarisCallContext); + when(realmContext.getRealmIdentifier()).thenReturn(REALM); + when(securityContext.getUserPrincipal()).thenReturn(principal); + when(principal.getName()).thenReturn(TEST_USER); + when(((PolarisPrincipal) principal).getRoles()).thenReturn(Set.of("role1", "role2")); + listener.callContext = callContext; + listener.securityContext = securityContext; + + return listener; + } + + @Test + void shouldCreateLogGroupAndStream() { + CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient(); + AwsCloudWatchEventListener listener = createListener(client); + + // Start the listener which should create the log group and stream + listener.start(); + + try { + verifyLogGroupAndStreamExist(client); + } finally { + client.close(); + listener.shutdown(); + } + } + + @Test + void shouldAcceptPreviouslyCreatedLogGroupAndStream() { + CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient(); + client.createLogGroup(CreateLogGroupRequest.builder().logGroupName(LOG_GROUP).build()).join(); + client + .createLogStream( + CreateLogStreamRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamName(LOG_STREAM) + .build()) + .join(); + verifyLogGroupAndStreamExist(client); + + AwsCloudWatchEventListener listener = createListener(client); + listener.start(); + try { + verifyLogGroupAndStreamExist(client); + } finally { + client.close(); + listener.shutdown(); + } + } + + @Test + void shouldSendEventToCloudWatch() { + CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient(); + AwsCloudWatchEventListener listener = createListener(client); + listener.start(); + try { + // Create and send a test event + TableIdentifier testTable = TableIdentifier.of("test_namespace", "test_table"); + AfterTableRefreshedEvent event = new AfterTableRefreshedEvent(testTable); + listener.onAfterTableRefreshed(event); + + Awaitility.await("expected amount of records should be sent to CloudWatch") + .atMost(Duration.ofSeconds(30)) + .pollDelay(Duration.ofMillis(100)) + .pollInterval(Duration.ofMillis(100)) + .untilAsserted( + () -> { + GetLogEventsResponse resp = + client + .getLogEvents( + GetLogEventsRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamName(LOG_STREAM) + .build()) + .join(); + assertThat(resp.events().size()).isGreaterThan(0); + }); + GetLogEventsResponse logEvents = + client + .getLogEvents( + GetLogEventsRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamName(LOG_STREAM) + .build()) + .join(); + + assertThat(logEvents.events()) + .hasSize(1) + .first() + .satisfies( + logEvent -> { + String message = logEvent.message(); + assertThat(message).contains(REALM); + assertThat(message).contains(AfterTableRefreshedEvent.class.getSimpleName()); + assertThat(message).contains(TEST_USER); + assertThat(message).contains(testTable.toString()); + }); + } finally { + // Clean up + listener.shutdown(); + client.close(); + } + } + + @Test + void shouldSendEventInSynchronousMode() { + CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient(); + + // Test synchronous mode + when(config.synchronousMode()).thenReturn(true); + AwsCloudWatchEventListener syncListener = createListener(client); + syncListener.start(); + try { + // Create and send a test event synchronously + TableIdentifier syncTestTable = TableIdentifier.of("test_namespace", "test_table_sync"); + AfterTableRefreshedEvent syncEvent = new AfterTableRefreshedEvent(syncTestTable); + syncListener.onAfterTableRefreshed(syncEvent); + + Awaitility.await("expected amount of records should be sent to CloudWatch") + .atMost(Duration.ofSeconds(30)) + .pollDelay(Duration.ofMillis(100)) + .pollInterval(Duration.ofMillis(100)) + .untilAsserted( + () -> { + GetLogEventsResponse resp = + client + .getLogEvents( + GetLogEventsRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamName(LOG_STREAM) + .build()) + .join(); + assertThat(resp.events().size()).isGreaterThan(0); + }); + + GetLogEventsResponse logEvents = + client + .getLogEvents( + GetLogEventsRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamName(LOG_STREAM) + .build()) + .join(); + + assertThat(logEvents.events()).hasSize(1); + + // Verify sync event + assertThat(logEvents.events()) + .anySatisfy( + logEvent -> { + String message = logEvent.message(); + assertThat(message).contains("test_table_sync"); + assertThat(message).contains("AfterTableRefreshedEvent"); + }); + } finally { + // Clean up + syncListener.shutdown(); + client.close(); + } + } + + @Test + void ensureObjectMapperCustomizerIsApplied() { + AwsCloudWatchEventListener listener = createListener(createCloudWatchAsyncClient()); + listener.start(); + + assertThat(listener.objectMapper.getPropertyNamingStrategy()) + .isInstanceOf(PropertyNamingStrategies.KebabCaseStrategy.class); + assertThat(listener.objectMapper.getFactory().streamReadConstraints().getMaxDocumentLength()) + .isEqualTo(MAX_BODY_SIZE.longValue()); + } + + private void verifyLogGroupAndStreamExist(CloudWatchLogsAsyncClient client) { + // Verify log group exists + DescribeLogGroupsResponse groups = + client + .describeLogGroups( + DescribeLogGroupsRequest.builder().logGroupNamePrefix(LOG_GROUP).build()) + .join(); + assertThat(groups.logGroups()) + .hasSize(1) + .first() + .satisfies(group -> assertThat(group.logGroupName()).isEqualTo(LOG_GROUP)); + + // Verify log stream exists + DescribeLogStreamsResponse streams = + client + .describeLogStreams( + DescribeLogStreamsRequest.builder() + .logGroupName(LOG_GROUP) + .logStreamNamePrefix(LOG_STREAM) + .build()) + .join(); + assertThat(streams.logStreams()) + .hasSize(1) + .first() + .satisfies(stream -> assertThat(stream.logStreamName()).isEqualTo(LOG_STREAM)); + } +} diff --git a/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version b/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version new file mode 100644 index 0000000000..fd65524510 --- /dev/null +++ b/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version @@ -0,0 +1,22 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# Dockerfile to provide the image name and tag to a test. +# Version is managed by Renovate - do not edit. +FROM localstack/localstack:3.4 diff --git a/site/content/in-dev/unreleased/configuration.md b/site/content/in-dev/unreleased/configuration.md index fec8940d6b..103b8c9486 100644 --- a/site/content/in-dev/unreleased/configuration.md +++ b/site/content/in-dev/unreleased/configuration.md @@ -78,46 +78,51 @@ read-only mode, as Polaris only reads the configuration file once, at startup. ## Polaris Configuration Options Reference -| Configuration Property | Default Value | Description | -|----------------------------------------------------------------------------------------|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `polaris.persistence.type` | `relational-jdbc` | Define the persistence backend used by Polaris (`in-memory`, `relational-jdbc`, `eclipse-link` (deprecated)). See [Configuring Apache Polaris for Production)[{{% ref "configuring-polaris-for-production.md" %}}) | -| `polaris.persistence.relational.jdbc.max-retries` | `1` | Total number of retries JDBC persistence will attempt on connection resets or serialization failures before giving up. | -| `polaris.persistence.relational.jdbc.max_duaration_in_ms` | `5000 ms` | Max time interval (ms) since the start of a transaction when retries can be attempted. | -| `polaris.persistence.relational.jdbc.initial_delay_in_ms` | `100 ms` | Initial delay before retrying. The delay is doubled after each retry. | -| `polaris.persistence.eclipselink.configurationFile` | | Define the location of the `persistence.xml`. By default, it's the built-in `persistence.xml` in use. | -| `polaris.persistence.eclipselink.persistenceUnit` | `polaris` | Define the name of the persistence unit to use, as defined in the `persistence.xml`. | -| `polaris.realm-context.type` | `default` | Define the type of the Polaris realm to use. | -| `polaris.realm-context.realms` | `POLARIS` | Define the list of realms to use. | -| `polaris.realm-context.header-name` | `Polaris-Realm` | Define the header name defining the realm context. | -| `polaris.features."ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING"` | `false` | Flag to enforce check if credential rotation. | -| `polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"` | `FILE` | Define the catalog supported storage. Supported values are `S3`, `GCS`, `AZURE`, `FILE`. | -| `polaris.features.realm-overrides."my-realm"."SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION"` | `true` | "Override" realm features, here the skip credential subscoping indirection flag. | -| `polaris.authentication.authenticator.type` | `default` | Define the Polaris authenticator type. | -| `polaris.authentication.token-service.type` | `default` | Define the Polaris token service type. | -| `polaris.authentication.token-broker.type` | `rsa-key-pair` | Define the Polaris token broker type. Also configure the location of the key files. For RSA: if the locations of the key files are not configured, an ephemeral key-pair will be created on each Polaris server instance startup, which breaks existing tokens after server restarts and is also incompatible with running multiple Polaris server instances. | -| `polaris.authentication.token-broker.max-token-generation` | `PT1H` | Define the max token generation policy on the token broker. | -| `polaris.authentication.token-broker.rsa-key-pair.private-key-file` | | Define the location of the RSA-256 private key file, if present the `public-key` file must be specified, too. | -| `polaris.authentication.token-broker.rsa-key-pair.public-key-file` | | Define the location of the RSA-256 public key file, if present the `private-key` file must be specified, too. | -| `polaris.authentication.token-broker.symmetric-key.secret` | `secret` | Define the secret of the symmetric key. | -| `polaris.authentication.token-broker.symmetric-key.file` | `/tmp/symmetric.key` | Define the location of the symmetric key file. | -| `polaris.storage.aws.access-key` | `accessKey` | Define the AWS S3 access key. If unset, the default credential provider chain will be used. | -| `polaris.storage.aws.secret-key` | `secretKey` | Define the AWS S3 secret key. If unset, the default credential provider chain will be used. | -| `polaris.storage.gcp.token` | `token` | Define the Google Cloud Storage token. If unset, the default credential provider chain will be used. | -| `polaris.storage.gcp.lifespan` | `PT1H` | Define the Google Cloud Storage lifespan type. If unset, the default credential provider chain will be used. | -| `polaris.log.request-id-header-name` | `Polaris-Request-Id` | Define the header name to match request ID in the log. | -| `polaris.log.mdc.aid` | `polaris` | Define the log context (e.g. MDC) AID. | -| `polaris.log.mdc.sid` | `polaris-service` | Define the log context (e.g. MDC) SID. | -| `polaris.rate-limiter.filter.type` | `no-op` | Define the Polaris rate limiter. Supported values are `no-op`, `token-bucket`. | -| `polaris.rate-limiter.token-bucket.type` | `default` | Define the token bucket rate limiter. | -| `polaris.rate-limiter.token-bucket.requests-per-second` | `9999` | Define the number of requests per second for the token bucket rate limiter. | -| `polaris.rate-limiter.token-bucket.window` | `PT10S` | Define the window type for the token bucket rate limiter. | -| `polaris.metrics.tags.=` | `application=Polaris` | Define arbitrary metric tags to include in every request. | -| `polaris.metrics.realm-id-tag.api-metrics-enabled` | `false` | Whether to enable the `realm_id` metric tag in API metrics. | -| `polaris.metrics.realm-id-tag.http-metrics-enabled` | `false` | Whether to enable the `realm_id` metric tag in HTTP request metrics. | -| `polaris.metrics.realm-id-tag.http-metrics-max-cardinality` | `100` | The maximum cardinality for the `realm_id` tag in HTTP request metrics. | -| `polaris.tasks.max-concurrent-tasks` | `100` | Define the max number of concurrent tasks. | -| `polaris.tasks.max-queued-tasks` | `1000` | Define the max number of tasks in queue. | - | `polaris.config.rollback.compaction.on-conflicts.enabled` | `false` | When set to true Polaris will apply the deconfliction by rollbacking those REPLACE operations snapshots which have the property of `polaris.internal.rollback.compaction.on-conflict` in their snapshot summary set to `rollback`, to resolve conflicts at the server end. | +| Configuration Property | Default Value | Description | +|----------------------------------------------------------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `polaris.persistence.type` | `relational-jdbc` | Define the persistence backend used by Polaris (`in-memory`, `relational-jdbc`, `eclipse-link` (deprecated)). See [Configuring Apache Polaris for Production)[{{% ref "configuring-polaris-for-production.md" %}}) | +| `polaris.persistence.relational.jdbc.max-retries` | `1` | Total number of retries JDBC persistence will attempt on connection resets or serialization failures before giving up. | +| `polaris.persistence.relational.jdbc.max_duaration_in_ms` | `5000 ms` | Max time interval (ms) since the start of a transaction when retries can be attempted. | +| `polaris.persistence.relational.jdbc.initial_delay_in_ms` | `100 ms` | Initial delay before retrying. The delay is doubled after each retry. | +| `polaris.persistence.eclipselink.configurationFile` | | Define the location of the `persistence.xml`. By default, it's the built-in `persistence.xml` in use. | +| `polaris.persistence.eclipselink.persistenceUnit` | `polaris` | Define the name of the persistence unit to use, as defined in the `persistence.xml`. | +| `polaris.realm-context.type` | `default` | Define the type of the Polaris realm to use. | +| `polaris.realm-context.realms` | `POLARIS` | Define the list of realms to use. | +| `polaris.realm-context.header-name` | `Polaris-Realm` | Define the header name defining the realm context. | +| `polaris.features."ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING"` | `false` | Flag to enforce check if credential rotation. | +| `polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"` | `FILE` | Define the catalog supported storage. Supported values are `S3`, `GCS`, `AZURE`, `FILE`. | +| `polaris.features.realm-overrides."my-realm"."SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION"` | `true` | "Override" realm features, here the skip credential subscoping indirection flag. | +| `polaris.authentication.authenticator.type` | `default` | Define the Polaris authenticator type. | +| `polaris.authentication.token-service.type` | `default` | Define the Polaris token service type. | +| `polaris.authentication.token-broker.type` | `rsa-key-pair` | Define the Polaris token broker type. Also configure the location of the key files. For RSA: if the locations of the key files are not configured, an ephemeral key-pair will be created on each Polaris server instance startup, which breaks existing tokens after server restarts and is also incompatible with running multiple Polaris server instances. | +| `polaris.authentication.token-broker.max-token-generation` | `PT1H` | Define the max token generation policy on the token broker. | +| `polaris.authentication.token-broker.rsa-key-pair.private-key-file` | | Define the location of the RSA-256 private key file, if present the `public-key` file must be specified, too. | +| `polaris.authentication.token-broker.rsa-key-pair.public-key-file` | | Define the location of the RSA-256 public key file, if present the `private-key` file must be specified, too. | +| `polaris.authentication.token-broker.symmetric-key.secret` | `secret` | Define the secret of the symmetric key. | +| `polaris.authentication.token-broker.symmetric-key.file` | `/tmp/symmetric.key` | Define the location of the symmetric key file. | +| `polaris.storage.aws.access-key` | `accessKey` | Define the AWS S3 access key. If unset, the default credential provider chain will be used. | +| `polaris.storage.aws.secret-key` | `secretKey` | Define the AWS S3 secret key. If unset, the default credential provider chain will be used. | +| `polaris.storage.gcp.token` | `token` | Define the Google Cloud Storage token. If unset, the default credential provider chain will be used. | +| `polaris.storage.gcp.lifespan` | `PT1H` | Define the Google Cloud Storage lifespan type. If unset, the default credential provider chain will be used. | +| `polaris.log.request-id-header-name` | `Polaris-Request-Id` | Define the header name to match request ID in the log. | +| `polaris.log.mdc.aid` | `polaris` | Define the log context (e.g. MDC) AID. | +| `polaris.log.mdc.sid` | `polaris-service` | Define the log context (e.g. MDC) SID. | +| `polaris.rate-limiter.filter.type` | `no-op` | Define the Polaris rate limiter. Supported values are `no-op`, `token-bucket`. | +| `polaris.rate-limiter.token-bucket.type` | `default` | Define the token bucket rate limiter. | +| `polaris.rate-limiter.token-bucket.requests-per-second` | `9999` | Define the number of requests per second for the token bucket rate limiter. | +| `polaris.rate-limiter.token-bucket.window` | `PT10S` | Define the window type for the token bucket rate limiter. | +| `polaris.metrics.tags.=` | `application=Polaris` | Define arbitrary metric tags to include in every request. | +| `polaris.metrics.realm-id-tag.api-metrics-enabled` | `false` | Whether to enable the `realm_id` metric tag in API metrics. | +| `polaris.metrics.realm-id-tag.http-metrics-enabled` | `false` | Whether to enable the `realm_id` metric tag in HTTP request metrics. | +| `polaris.metrics.realm-id-tag.http-metrics-max-cardinality` | `100` | The maximum cardinality for the `realm_id` tag in HTTP request metrics. | +| `polaris.tasks.max-concurrent-tasks` | `100` | Define the max number of concurrent tasks. | +| `polaris.tasks.max-queued-tasks` | `1000` | Define the max number of tasks in queue. | +| `polaris.config.rollback.compaction.on-conflicts.enabled` | `false` | When set to true Polaris will apply the deconfliction by rollbacking those REPLACE operations snapshots which have the property of `polaris.internal.rollback.compaction.on-conflict` in their snapshot summary set to `rollback`, to resolve conflicts at the server end. | +| `polaris.event-listener.type` | `no-op` | Define the Polaris event listener type. Supported values are `no-op`, `aws-cloudwatch`. | +| `polaris.event-listener.aws-cloudwatch.log-group` | `polaris-cloudwatch-default-group` | Define the AWS CloudWatch log group name for the event listener. | +| `polaris.event-listener.aws-cloudwatch.log-stream` | `polaris-cloudwatch-default-stream`| Define the AWS CloudWatch log stream name for the event listener. Ensure that Polaris' IAM credentials have the following actions: "PutLogEvents", "DescribeLogStreams", and "DescribeLogGroups" on the specified log stream/group. If the specified log stream/group does not exist, then "CreateLogStream" and "CreateLogGroup" will also be required. | +| `polaris.event-listener.aws-cloudwatch.region` | `us-east-1` | Define the AWS region for the CloudWatch event listener. | +| `polaris.event-listener.aws-cloudwatch.synchronous-mode` | `false` | Define whether log events are sent to CloudWatch synchronously. When set to true, events are sent synchronously which may impact performance but ensures immediate delivery. When false (default), events are sent asynchronously for better performance. | There are non Polaris configuration properties that can be useful: