[HDFS-16518] KeyProviderCache close cached KeyProvider with Hadoop ShutdownHookManager

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.0
• Fix Version/s: 3.4.0, 2.10.2, 3.3.5
• Component/s: hdfs
• Labels: pull-request-available
• Flags: Patch
• Assignee: Lei Yang
• Reporter: Lei Yang
• Created: 22/Mar/22 17:03
• Updated: 30/Mar/22 21:12
• Resolved: 30/Mar/22 21:12

Description

KeyProvider implements Closable interface but some custom implementation of KeyProvider also needs explicit close in KeyProviderCache. An example is to use custom KeyProvider in DFSClient to integrate read encrypted file on HDFS. 

KeyProvider  currently gets closed in KeyProviderCache only when cache entry is expired or invalidated. In some cases, this is not happening. This seems related to guava cache.

This patch is to use hadoop JVM shutdownhookManager to globally cleanup cache entries and thus close KeyProvider using cache hook right after filesystem instance gets closed in a deterministic way.

Class KeyProviderCache

...
 public KeyProviderCache(long expiryMs) {
  cache = CacheBuilder.newBuilder()
    .expireAfterAccess(expiryMs, TimeUnit.MILLISECONDS)
    .removalListener(new RemovalListener<URI, KeyProvider>() {
      @Override
      public void onRemoval(
          @Nonnull RemovalNotification<URI, KeyProvider> notification) {
        try {
          assert notification.getValue() != null;
          notification.getValue().close();
        } catch (Throwable e) {
          LOG.error(
              "Error closing KeyProvider with uri ["
                  + notification.getKey() + "]", e);
        }
      }
    })
    .build(); 
}

We could have made a new function KeyProviderCache#close, have each DFSClient call this function and close KeyProvider at the end of each DFSClient#close call but it will expose another problem to potentially close global cache among different DFSClient instances.

 

Issue Links

• links to: GitHub Pull Request #4100