Repository navigation
ATLAS-5425:Implement getEntitiesWithTagChanges for RDBMS audit repository - #785
Closed
bhor-sanket wants to merge 9 commits into
Closed
bhor-sanket wants to merge 9 commits into
bhor-sanket wants to merge 9 commits into
Conversation
…ry server files and enumerating filesystem paths (apache#783) Co-authored-by: Mandar Ambawane <mandar.ambawane@cloudera.com>
…alls. (apache#786) * ATLAS-5430: Add SPIFFE header authentication for service-to-service calls. Align Atlas header pre-auth with Ranger by accepting configured SPIFFE ID headers (e.g. X-Spiffe-Id) and using the service-account segment as the trusted-proxy principal when no username header is present. Co-authored-by: Cursor <cursoragent@cursor.com> * ATLAS-5430: Load SPIFFE header names with getStringArray for list config. Comma-separated atlas.authentication.method.header.spiffe values were truncated when read via getString; use getStringArray and extend tests. Document properties and enable header-auth Docker settings for local E2E verification. Co-authored-by: Cursor <cursoragent@cursor.com> * ATLAS-5430 - Address review comments in PR apache#786 --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…pre-auth for Atlas rest-notification service. (apache#787) Reuse AtlasHeaderPreAuthFilter from server-common, wire it into rest-notification security for header based authentication and SPIFFE verification.
* ATLAS-5432: Fix Enunciate JDK 8 build failure and enable parallel matrix execution * ATLAS-5432: changes to disable parallel matrix execution * ATLAS-5432: Increase CI timeout from 180 to 480 minutes * Revert "ATLAS-5432: Increase CI timeout from 180 to 480 minutes" This reverts commit 23c233a. --------- Co-authored-by: sanket.bhor <sanket.bhor@cloudera.com>
This reverts commit a4f915e.
bhor-sanket
marked this pull request as draft
October 26, 2026 04:17
bhor-sanket
marked this pull request as ready for review
October 26, 2026 04:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Background
Apache Atlas supports multiple audit repository backends (HBase, RDBMS, InMemory, Cassandra, Noop). The REST
API GET /api/atlas/v2/entity/bulk/headers?tagUpdateStartTime={epoch_ms}enables consumers to retrieve entities that had classification (tag) changes within a given time window. This API is used byClassificationAssociator.Retrieverto synchronize classification state across systems.Problem Statement
guidHeaderMapwhen Atlas is configured with the RDBMS audit backend(
atlas.EntityAuditRepository.impl=org.apache.atlas.repository.audit.rdbms.RdbmsBasedAuditRepository).CLASSIFICATION_ADD, CLASSIFICATION_DELETE, CLASSIFICATION_UPDATE) within the specified time range, matching the HBasebackend behavior.
RdbmsBasedAuditRepository.getEntitiesWithTagChanges(fromTimestamp, toTimestamp)was a // TODO: stub returning Collections.emptySet().How the patch resolves it
The implementation mirrors the HBase backend's behavior using JPA/JPQL against the
atlas_entity_audittable.DbEntityAudit.getDistinctEntityIdsByActionPrefixAndTimeRange— queriesatlas_entity_auditfor distinct entity IDs whereoperation LIKE 'CLASSIFICATION_%'within a half-open time range (fromTimestamp, toTimestamp)SELECT DISTINCT obj.entityIdto avoid materializing full DbEntityAudit objectsLIKE 'CLASSIFICATION_%'matchesCLASSIFICATION_ADD, CLASSIFICATION_DELETE, CLASSIFICATION_UPDATEbut excludesPROPAGATED_CLASSIFICATION_*— exact parity with HBase'sBinaryPrefixComparator("CLASSIFICATION_")
getDistinctEntityIdsByActionPrefixAndTimeRange(String actionPrefix, long fromTimestamp, long toTimestamp)— executes the named query with parameterized action prefix and time rangeRdbmsTransaction + DbEntityAuditDaopattern (consistent with existing listEventsV2 method)How was this patch tested?
Setup :
GET /api/atlas/v2/entity/bulk/headers?tagUpdateStartTime={epoch_ms}Use-cases validation :
classification). Passed.
entity (PROPAGATED_CLASSIFICATION_ADD) excluded — matches HBase behavior. Passed.
Unit testing
Test class: AuditRepositoryTestBase.java (executed via InMemoryAuditRepositoryTest)
Tests added: