Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HADOOP-18373. IOStatisticsContext tuning #4705

Merged
merged 2 commits into from
Aug 8, 2022

Conversation

virajjasani
Copy link
Contributor

Description of PR

Tuning of the IOStatisticsContext code

change property name to "fs.iostatistics...." for consistent naming

Edit core-site.xml to always collect context iOStatistics

@virajjasani
Copy link
Contributor Author

virajjasani commented Aug 4, 2022

Tested against us-west-2 endpoint:

$ mvn -Dparallel-tests -DtestsThreadCount=8 clean verify

[INFO] --- maven-surefire-plugin:3.0.0-M1:test (default-test) @ hadoop-aws ---
[INFO] 
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.hadoop.fs.s3a.commit.staging.TestStagingPartitionedJobCommit
[INFO] Running org.apache.hadoop.fs.s3a.commit.staging.TestStagingPartitionedFileListing
[INFO] Running org.apache.hadoop.fs.s3a.commit.TestMagicCommitPaths
...
...
...
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.213 s - in org.apache.hadoop.mapreduce.filecache.TestS3AResourceScope
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 24.88 s - in org.apache.hadoop.fs.s3a.audit.impl.TestActiveAuditManagerThreadLeakage
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 25.786 s - in org.apache.hadoop.fs.s3a.TestS3AInputStreamRetry
[INFO] Tests run: 63, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 50.546 s - in org.apache.hadoop.fs.s3a.commit.staging.TestStagingCommitter
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 54.939 s - in org.apache.hadoop.fs.s3a.commit.staging.TestDirectoryCommitterScale
[INFO] 
[INFO] Results:
[INFO] 
[WARNING] Tests run: 406, Failures: 0, Errors: 0, Skipped: 4
[INFO] 
[INFO] 



[INFO] --- maven-failsafe-plugin:3.0.0-M1:integration-test (default-integration-test) @ hadoop-aws ---
[INFO] 
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.hadoop.fs.contract.s3a.ITestS3AContractMultipartUploader
[INFO] Running org.apache.hadoop.fs.contract.s3a.ITestS3AContractSeek
[INFO] Running org.apache.hadoop.fs.contract.s3a.ITestS3AContractRename
[INFO] Running org.apache.hadoop.fs.contract.s3a.ITestS3AContractDistCp
...
...
...
[ERROR] Errors: 
[ERROR]   ITestS3ATemporaryCredentials.testSTS:133 » AccessDenied : request session cred...
[ERROR]   ITestDelegatedMRJob.setup:182->AbstractS3ATestBase.setup:111->AbstractFSContractTestBase.setup:189 » ServiceState
[ERROR]   ITestDelegatedMRJob.setup:182->AbstractS3ATestBase.setup:111->AbstractFSContractTestBase.setup:189 » ServiceState
[INFO] 
[ERROR] Tests run: 1139, Failures: 2, Errors: 3, Skipped: 190
[INFO] 
[INFO] 




[INFO] --- maven-failsafe-plugin:3.0.0-M1:integration-test (sequential-integration-tests) @ hadoop-aws ---
[INFO] 
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.hadoop.fs.contract.s3a.ITestS3AContractRootDir
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 33.217 s - in org.apache.hadoop.fs.contract.s3a.ITestS3AContractRootDir
...
...
...
[INFO] Running org.apache.hadoop.fs.s3a.ITestS3AEncryptionSSEC
[INFO] Tests run: 24, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 124.403 s - in org.apache.hadoop.fs.s3a.ITestS3AEncryptionSSEC
[INFO] 
[INFO] Results:
[INFO] 
[WARNING] Tests run: 124, Failures: 0, Errors: 0, Skipped: 84
[INFO] 
[INFO] 

Errors:

[ERROR] Tests run: 6, Failures: 0, Errors: 2, Skipped: 2, Time elapsed: 29.185 s <<< FAILURE! - in org.apache.hadoop.fs.s3a.auth.delegation.ITestDelegatedMRJob
[ERROR] testCommonCrawlLookup[1](org.apache.hadoop.fs.s3a.auth.delegation.ITestDelegatedMRJob)  Time elapsed: 0.187 s  <<< ERROR!
org.apache.hadoop.service.ServiceStateException: org.apache.hadoop.fs.s3a.auth.delegation.DelegationTokenIOException: no credentials in configuration or environment variables:  No AWS credentials
	at org.apache.hadoop.service.ServiceStateException.convert(ServiceStateException.java:105)
	at org.apache.hadoop.service.AbstractService.start(AbstractService.java:204)
	at org.apache.hadoop.fs.s3a.S3AFileSystem.bindAWSClient(S3AFileSystem.java:858)
	at org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:523)
	at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3563)
	at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
	at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3668)
	at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3615)
	at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:556)
	at org.apache.hadoop.fs.contract.AbstractBondedFSContract.init(AbstractBondedFSContract.java:72)
	at org.apache.hadoop.fs.contract.AbstractFSContractTestBase.setup(AbstractFSContractTestBase.java:189)
	at org.apache.hadoop.fs.s3a.AbstractS3ATestBase.setup(AbstractS3ATestBase.java:111)
	at org.apache.hadoop.fs.s3a.auth.delegation.ITestDelegatedMRJob.setup(ITestDelegatedMRJob.java:182)


[ERROR] testJobSubmissionCollectsTokens[1](org.apache.hadoop.fs.s3a.auth.delegation.ITestDelegatedMRJob)  Time elapsed: 0.097 s  <<< ERROR!
org.apache.hadoop.service.ServiceStateException: org.apache.hadoop.fs.s3a.auth.delegation.DelegationTokenIOException: no credentials in configuration or environment variables:  No AWS credentials
	at org.apache.hadoop.service.ServiceStateException.convert(ServiceStateException.java:105)
	at org.apache.hadoop.service.AbstractService.start(AbstractService.java:204)
	at org.apache.hadoop.fs.s3a.S3AFileSystem.bindAWSClient(S3AFileSystem.java:858)
	at org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:523)
	at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3563)
	at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
	at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3668)
	at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3615)
	at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:556)
	at org.apache.hadoop.fs.contract.AbstractBondedFSContract.init(AbstractBondedFSContract.java:72)
	at org.apache.hadoop.fs.contract.AbstractFSContractTestBase.setup(AbstractFSContractTestBase.java:189)
	at org.apache.hadoop.fs.s3a.AbstractS3ATestBase.setup(AbstractS3ATestBase.java:111)
	at org.apache.hadoop.fs.s3a.auth.delegation.ITestDelegatedMRJob.setup(ITestDelegatedMRJob.java:182)


[ERROR] Tests run: 14, Failures: 0, Errors: 1, Skipped: 4, Time elapsed: 153.197 s <<< FAILURE! - in org.apache.hadoop.fs.s3a.ITestS3ATemporaryCredentials
[ERROR] testSTS(org.apache.hadoop.fs.s3a.ITestS3ATemporaryCredentials)  Time elapsed: 2.979 s  <<< ERROR!
java.nio.file.AccessDeniedException: : request session credentials: com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: Cannot call GetSessionToken with session credentials (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: 4ea755eb-da74-435c-a48c-443a76f6c194; Proxy: null):AccessDenied
	at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:247)
	at org.apache.hadoop.fs.s3a.Invoker.once(Invoker.java:124)
	at org.apache.hadoop.fs.s3a.Invoker.lambda$retry$4(Invoker.java:376)
	at org.apache.hadoop.fs.s3a.Invoker.retryUntranslated(Invoker.java:468)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:372)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:347)
	at org.apache.hadoop.fs.s3a.auth.STSClientFactory$STSClient.requestSessionCredentials(STSClientFactory.java:202)
	at org.apache.hadoop.fs.s3a.ITestS3ATemporaryCredentials.testSTS(ITestS3ATemporaryCredentials.java:133)


@hadoop-yetus
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 36s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 1s codespell was not available.
+0 🆗 detsecrets 0m 1s detect-secrets was not available.
+0 🆗 xmllint 0m 1s xmllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
+1 💚 test4tests 0m 0s The patch appears to include 1 new or modified test files.
_ trunk Compile Tests _
+0 🆗 mvndep 15m 6s Maven dependency ordering for branch
+1 💚 mvninstall 25m 43s trunk passed
+1 💚 compile 23m 13s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 compile 20m 48s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 checkstyle 4m 21s trunk passed
+1 💚 mvnsite 3m 44s trunk passed
+1 💚 javadoc 2m 59s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 40s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 0s trunk passed
+1 💚 shadedclient 22m 22s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 33s Maven dependency ordering for patch
+1 💚 mvninstall 1m 45s the patch passed
+1 💚 compile 22m 25s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javac 22m 25s the patch passed
+1 💚 compile 20m 48s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 javac 20m 48s the patch passed
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 checkstyle 4m 12s the patch passed
+1 💚 mvnsite 3m 41s the patch passed
+1 💚 javadoc 2m 50s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 55s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 9s the patch passed
+1 💚 shadedclient 22m 36s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 unit 18m 38s hadoop-common in the patch passed.
+1 💚 unit 3m 24s hadoop-aws in the patch passed.
+1 💚 asflicense 1m 36s The patch does not generate ASF License warnings.
242m 32s
Subsystem Report/Notes
Docker ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/1/artifact/out/Dockerfile
GITHUB PR #4705
Optional Tests dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets xmllint
uname Linux 7b2f44c3a64d 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 8c5d530beca4051c796f229f7c4b0c3e90e5b843
Default Java Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Multi-JDK versions /usr/lib/jvm/java-11-openjdk-amd64:Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Test Results https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/1/testReport/
Max. process+thread count 1301 (vs. ulimit of 5500)
modules C: hadoop-common-project/hadoop-common hadoop-tools/hadoop-aws U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/1/console
versions git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

@virajjasani
Copy link
Contributor Author

virajjasani commented Aug 5, 2022

For ITestS3ATemporaryCredentials test, I have provides these configs:

  1. test.fs.s3a.name (value: s3a://{actual_bucket_name})
  2. fs.contract.test.fs.s3a (value: ${test.fs.s3a.name})
  3. test.sts.endpoint (value: sts.us-west-2.amazonaws.com)
  4. fs.s3a.endpoint (value: s3-us-west-2.amazonaws.com)
  5. fs.s3a.assumed.role.sts.endpoint (value: ${test.sts.endpoint})
  6. fs.s3a.assumed.role.sts.endpoint.region (value: us-west-2)
  7. fs.s3a.aws.credentials.provider (value: org.apache.hadoop.fs.s3a.TemporaryAWSCredentialsProvider)
  8. fs.s3a.session.token
  9. fs.s3a.access.key
  10. fs.s3a.secret.key

Tried with both buckets, with and without ACL enabled.
However, 4 tests fail with:

java.nio.file.AccessDeniedException: : request session credentials: com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: The security token included in the request is invalid. (Service: AWSSecurityTokenService; Status Code: 403; Error Code: InvalidClientTokenId; Request ID: 04bfbc37-dfb3-4984-b8f7-8785dd3fe172; Proxy: null):InvalidClientTokenId
	at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:247)
	at org.apache.hadoop.fs.s3a.Invoker.once(Invoker.java:124)
	at org.apache.hadoop.fs.s3a.Invoker.lambda$retry$4(Invoker.java:376)
	at org.apache.hadoop.fs.s3a.Invoker.retryUntranslated(Invoker.java:468)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:372)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:347)
	at org.apache.hadoop.fs.s3a.auth.STSClientFactory$STSClient.requestSessionCredentials(STSClientFactory.java:202)
	at org.apache.hadoop.fs.s3a.auth.MarshalledCredentialBinding.requestSessionCredentials(MarshalledCredentialBinding.java:212)
	at org.apache.hadoop.fs.s3a.S3ATestUtils.requestSessionCredentials(S3ATestUtils.java:663)
	at org.apache.hadoop.fs.s3a.S3ATestUtils.requestSessionCredentials(S3ATestUtils.java:644)
	at org.apache.hadoop.fs.s3a.ITestS3ATemporaryCredentials.testInvalidSTSBinding(ITestS3ATemporaryCredentials.java:258)

This doesn't seem relevant to the patch but wondering what I am missing in the configs specifically for ITestS3ATemporaryCredentials tests. Perhaps I missed something specific from the S3A docs?

@mehakmeet @steveloughran @mukund-thakur

@hadoop-yetus
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 37s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 1s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 xmllint 0m 0s xmllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
+1 💚 test4tests 0m 0s The patch appears to include 2 new or modified test files.
_ trunk Compile Tests _
+0 🆗 mvndep 15m 37s Maven dependency ordering for branch
+1 💚 mvninstall 25m 31s trunk passed
+1 💚 compile 23m 8s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 compile 20m 44s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 checkstyle 4m 25s trunk passed
+1 💚 mvnsite 3m 42s trunk passed
+1 💚 javadoc 2m 46s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 34s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 0s trunk passed
+1 💚 shadedclient 22m 10s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 32s Maven dependency ordering for patch
+1 💚 mvninstall 1m 46s the patch passed
+1 💚 compile 22m 21s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javac 22m 21s the patch passed
+1 💚 compile 20m 49s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 javac 20m 49s the patch passed
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 checkstyle 4m 16s the patch passed
+1 💚 mvnsite 3m 42s the patch passed
+1 💚 javadoc 2m 50s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 33s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 13s the patch passed
+1 💚 shadedclient 22m 25s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 unit 18m 52s hadoop-common in the patch passed.
+1 💚 unit 3m 16s hadoop-aws in the patch passed.
+1 💚 asflicense 1m 33s The patch does not generate ASF License warnings.
241m 35s
Subsystem Report/Notes
Docker ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/2/artifact/out/Dockerfile
GITHUB PR #4705
Optional Tests dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets xmllint
uname Linux fd12bfe710b5 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 127d230
Default Java Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Multi-JDK versions /usr/lib/jvm/java-11-openjdk-amd64:Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Test Results https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/2/testReport/
Max. process+thread count 3152 (vs. ulimit of 5500)
modules C: hadoop-common-project/hadoop-common hadoop-tools/hadoop-aws U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/2/console
versions git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

Copy link
Contributor

@steveloughran steveloughran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good. i think I'd prefer an enabled() as the public predicate

@@ -178,6 +178,12 @@
<value>true</value>
</property>

<!-- Enable IOStatisticsContext support for Thread level. -->
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mixed feelings here. hive team and others who serialize configs don't like us overfilling the xml file with defaults

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They might not have issue with test resource xml changes right?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no issues there at all

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets go with it

@hadoop-yetus
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 36s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 1s codespell was not available.
+0 🆗 detsecrets 0m 1s detect-secrets was not available.
+0 🆗 xmllint 0m 1s xmllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
+1 💚 test4tests 0m 0s The patch appears to include 2 new or modified test files.
_ trunk Compile Tests _
+0 🆗 mvndep 15m 27s Maven dependency ordering for branch
+1 💚 mvninstall 25m 34s trunk passed
+1 💚 compile 23m 4s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 compile 20m 52s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 checkstyle 4m 25s trunk passed
+1 💚 mvnsite 3m 44s trunk passed
+1 💚 javadoc 3m 0s trunk passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 40s trunk passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 4s trunk passed
+1 💚 shadedclient 22m 23s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 1m 5s Maven dependency ordering for patch
+1 💚 mvninstall 1m 48s the patch passed
+1 💚 compile 22m 25s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javac 22m 25s the patch passed
+1 💚 compile 20m 47s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 javac 20m 47s the patch passed
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 checkstyle 4m 19s the patch passed
+1 💚 mvnsite 3m 44s the patch passed
+1 💚 javadoc 2m 52s the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚 javadoc 2m 30s the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚 spotbugs 5m 2s the patch passed
+1 💚 shadedclient 22m 23s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 unit 18m 50s hadoop-common in the patch passed.
+1 💚 unit 3m 22s hadoop-aws in the patch passed.
+1 💚 asflicense 1m 37s The patch does not generate ASF License warnings.
243m 1s
Subsystem Report/Notes
Docker ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/3/artifact/out/Dockerfile
GITHUB PR #4705
Optional Tests dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets xmllint
uname Linux dd1b3ad009e9 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / e6292d5
Default Java Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Multi-JDK versions /usr/lib/jvm/java-11-openjdk-amd64:Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Test Results https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/3/testReport/
Max. process+thread count 1301 (vs. ulimit of 5500)
modules C: hadoop-common-project/hadoop-common hadoop-tools/hadoop-aws U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4705/3/console
versions git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

@steveloughran
Copy link
Contributor

InvalidClientTokenId

never seen that; docs say "AWS access key ID provided does not exist in our records."

it might be that the arn of the token you are asking for doesn't exist, or that you don't have permissions to create sessions for it and it is failing

Copy link
Contributor

@steveloughran steveloughran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

@steveloughran steveloughran merged commit 06f0f7d into apache:trunk Aug 8, 2022
@steveloughran
Copy link
Contributor

merged to trunk; testing branch-3.3 and will push up if all is good

asfgit pushed a commit that referenced this pull request Aug 8, 2022
The name of the option to enable/disable thread level statistics is
"fs.iostatistics.thread.level.enabled";

There is also an enabled() probe in IOStatisticsContext which can
be used to see if the thread level statistics is active.

Contributed by Viraj Jasani
@virajjasani
Copy link
Contributor Author

InvalidClientTokenId

never seen that; docs say "AWS access key ID provided does not exist in our records."

it might be that the arn of the token you are asking for doesn't exist, or that you don't have permissions to create sessions for it and it is failing

Thanks @steveloughran. Here is what I did: created role, provided policy, created user, provided the same policy. Updated role's trust relationship to allow user to perform assume-role on the role.
Performed assume-role with aws sts assume-role --role-arn arn:aws:iam::{account}:role/{role_name} --role-session-name "{role_name}" and it produced access-key, secret-key and session-token. Used these creds in auth-keys.xml, ran ITestS3ATemporaryCredentials tests, and testSTS() fails with:

java.nio.file.AccessDeniedException: : request session credentials: com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: Cannot call GetSessionToken with session credentials (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: 16996a06-fe91-47a7-a938-f4fd0eb0ff94; Proxy: null):AccessDenied

	at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:247)
	at org.apache.hadoop.fs.s3a.Invoker.once(Invoker.java:124)
	at org.apache.hadoop.fs.s3a.Invoker.lambda$retry$4(Invoker.java:376)
	at org.apache.hadoop.fs.s3a.Invoker.retryUntranslated(Invoker.java:468)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:372)
	at org.apache.hadoop.fs.s3a.Invoker.retry(Invoker.java:347)
	at org.apache.hadoop.fs.s3a.auth.STSClientFactory$STSClient.requestSessionCredentials(STSClientFactory.java:202)
	at org.apache.hadoop.fs.s3a.ITestS3ATemporaryCredentials.testSTS(ITestS3ATemporaryCredentials.java:133)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
	at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:61)
	at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:299)
	at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:293)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.lang.Thread.run(Thread.java:750)
Caused by: com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: Cannot call GetSessionToken with session credentials (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: 16996a06-fe91-47a7-a938-f4fd0eb0ff94; Proxy: null)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1879)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleServiceErrorResponse(AmazonHttpClient.java:1418)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1387)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1157)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:814)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:781)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:755)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:715)
	at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:697)
	at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:561)
	at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:541)
	at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.doInvoke(AWSSecurityTokenServiceClient.java:1727)
	at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:1694)
	at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:1683)
	at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.executeGetSessionToken(AWSSecurityTokenServiceClient.java:1621)
	at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.getSessionToken(AWSSecurityTokenServiceClient.java:1589)
	at org.apache.hadoop.fs.s3a.auth.STSClientFactory$STSClient.lambda$requestSessionCredentials$0(STSClientFactory.java:206)
	at org.apache.hadoop.fs.s3a.Invoker.once(Invoker.java:122)
	... 21 more

Perhaps the user (who did the assume-role) doesn't have some specific permission?

@virajjasani
Copy link
Contributor Author

I was able to figure out the issue, please ignore above comment.

@steveloughran
Copy link
Contributor

what was it? test running as other user?

fwiw i use a very restricted user/role for my s3 tests, so if that key ever leaked, it would limit the damage to accessing my test s3 buckets, assume one role, etc. not even start an EC2 vm

@virajjasani
Copy link
Contributor Author

what was it? test running as other user?

Basically for this test, I manually did the sts assume-role and then retrieved session token with aws sts get-session-token and also added this token to auth-keys, this was the root cause behind ITestS3ATemporaryCredentials#testSTS failure because calling GetSessionToken with session credentials (including session token) would not allow user to retrieve temporary creds. Besides, I also kept fs.s3a.aws.credentials.provider as TemporaryAWSCredentialsProvider. After bit of digging, when I realized that temporary credential provider cannot call the above API with session token, I removed session token and also removed fs.s3a.aws.credentials.provider to let the credential providers be picked up by default. After this change, test went smooth.

fwiw i use a very restricted user/role for my s3 tests, so if that key ever leaked, it would limit the damage to accessing my test s3 buckets, assume one role, etc. not even start an EC2 vm

Ah yes, this is definitely very good suggestion, thanks!

@steveloughran
Copy link
Contributor

yeah, you can't ask for session creds with session creds

cloudstore has a command to ask for session credentials with your full s3a secrets, prints as env vars, properties, xml
https://github.com/steveloughran/cloudstore/blob/trunk/src/main/site/sessionkey.md

handy for getting some secrets into a vm for a while

@virajjasani
Copy link
Contributor Author

cloudstore has a command to ask for session credentials with your full s3a secrets, prints as env vars, properties, xml
https://github.com/steveloughran/cloudstore/blob/trunk/src/main/site/sessionkey.md

Thank you for sharing, Steve!

HarshitGupta11 pushed a commit to HarshitGupta11/hadoop that referenced this pull request Nov 28, 2022
The name of the option to enable/disable thread level statistics is
"fs.iostatistics.thread.level.enabled";

There is also an enabled() probe in IOStatisticsContext which can
be used to see if the thread level statistics is active.

Contributed by Viraj Jasani
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants