Skip to content

[filesystem] Fix COS STS policy APPID and preserve session credentials - #3984

Open
damokelis wants to merge 2 commits into
apache:mainfrom
damokelis:agent/fix-cos-sts-appid
Open

[filesystem] Fix COS STS policy APPID and preserve session credentials#3984
damokelis wants to merge 2 commits into
apache:mainfrom
damokelis:agent/fix-cos-sts-appid

Conversation

@damokelis

@damokelis damokelis commented Aug 13, 2026

Copy link
Copy Markdown

Purpose

Linked issue: close #3983

The COS STS path had two independent causes of HTTP 403 failures:

  1. The default Tencent Cloud COS policy used uid/* as the resource owner. COS requires the bucket APPID.
  2. hadoop-cos 3.3.5 converted temporary COSSessionCredentials to BasicCOSCredentials, dropping the session token before COS requests. This is fixed by Hadoop HADOOP-19648 in hadoop-cos 3.5.0.

Brief change log

  • derive the APPID from the numeric suffix of a standard COS bucket name
  • use uid/<appid> in the bucket-scoped default policy
  • fail with an actionable message when the APPID cannot be derived
  • upgrade hadoop-cos from 3.3.5 to 3.5.0
  • simplify the Fluss token provider to return session credentials directly
  • add an integration-style unit test that initializes CosNFileSystem and verifies that the COS SDK still receives COSSessionCredentials through the Hadoop retry proxy

Tests

  • mvn -s /tmp/fluss-maven-settings.xml -Dmaven.repo.local=/tmp/fluss-m2-cos-sts -pl fluss-filesystems/fluss-fs-cos -DskipITs -Dcheckstyle.skip -Drat.skip -Dspotless.check.skip test
    • 3 tests passed
  • mvn -s /tmp/fluss-maven-settings.xml -Dmaven.repo.local=/tmp/fluss-m2-cos-sts -pl fluss-filesystems/fluss-fs-cos -am -DskipITs -Dcheckstyle.skip -Drat.skip -Dspotless.check.skip -DskipTests package
  • inspected the shaded JAR bytecode to confirm the credential adapter no longer creates BasicCOSCredentials
  • deployed the shaded COS filesystem JAR to a Fluss main + Flink 2.2.1 + Paimon 2.0.0 test cluster

Live end-to-end validation on TKE:

  • imported a 31-table MySQL snapshot through a DTS CDC sink into a fresh Fluss database
  • the full snapshot completed with about 141 million rows
  • MySQL CDC remained continuous after snapshot completion; the observed GTID checkpoint advanced and matched the current position
  • observed 802 CDC records sinked after the full load at the final verification point
  • all 31 Fluss tables used primary keys, 3 buckets, and table.datalake.freshness=10min
  • Fluss lake tiering downloaded KV snapshots from COS with no real HTTP 403/Forbidden/AccessDenied response
  • Paimon 2.0 committed snapshot-1 and LATEST for the fresh database in COS
  • verified non-empty snapshot metadata, including tables with 1,463 and 5,637,613 records
  • Coordinator, Tablet, DTS, JobManager, and TaskManager remained Running with zero restarts during validation
  • no OutOfOrderSequenceException was observed in DTS, Coordinator, or Tablet logs

API and Format

No public API or storage format change.

Documentation

No new user-facing feature. Users with a nonstandard bucket authority can continue to configure fs.cosn.userinfo.security_token_policy explicitly.

Generative AI disclosure

  • No generative AI tools used
  • Yes, OpenAI Codex was used to assist with investigation, implementation, test authoring, and live validation.

@damokelis damokelis changed the title [filesystem] Fix COS STS policy resource APPID [filesystem] Fix COS STS policy APPID and preserve session credentials Aug 13, 2026
@damokelis
damokelis marked this pull request as ready for review August 13, 2026 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] COS STS default policy uses an invalid wildcard owner UID

1 participant