[IMPALA-11501] Add flag to allow metadata-cache operations on masked tables

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: Impala 4.4.0
• Component/s: Catalog, Security
• Epic Color: ghx-label-14
• Assignee: Quanlong Huang
• Reporter: Quanlong Huang
• Created: 16/Aug/22 12:35
• Updated: 07/Mar/24 19:45
• Resolved: 14/Dec/23 04:55

Description

"REFRESH <table>" and "INVALIDATE METADATA <table>" are the table level metadata-cache operations that only used in Impala (not Hive, SparkSQL or else).

In Hive-Ranger plugin, when a table is masked (either by column-masking or row-filtering policy) for a user, the user can't perform any modification (insert/delete/update) on the table (RANGER-1087, RANGER-1100). However, Hive doesn't have those metadata-cache operations. It's a grey area whether we should block them or not.

Currently, Impala blocks metadata-cache operations as well (IMPALA-10554, IMPALA-11281). However, it's possible that, before upgrade, some data-consumer jobs already have REFRESH in them. It'd be better to have a flag to allow such operations for smooth upgrade process.

The flag can be something like "allow_refresh_by_masked_users".
CC fangyurao, csringhofer

Issue Links

• is related to: IMPALA-12591 Consider using getTableIfCached() in Analyzer#dbContainsTable()
• is related to: IMPALA-12670 CatalogdMetaProvider.getIfPresent() not throwing the underlying InconsistentMetadataFetchException
• relates to: IMPALA-10554 Block modifications when row-filter/column-mask is enabled for the user
• relates to: IMPALA-11281 Consider loading the table metadata for a ResetMetadataStmt