Repository navigation
[#13111] fix(test): Pull the MinIO test image from quay.io - #13112
Merged
Merged
Conversation
mchades
approved these changes
Sep 13, 2026
Code Coverage Report
|
This was referenced Sep 14, 2026
jerryshao
pushed a commit
that referenced
this pull request
Sep 15, 2026
…13155) ### What changes were proposed in this pull request? Replace the shared MinIO fixture with RustFS **1.0.0-rc.6** for fileset connection testing and Iceberg credential vending. The fixture consumes one version-and-digest pin from a packaged Docker Compose resource, waits for signed S3 readiness, and creates buckets through the AWS SDK. Preserve the Hadoop and Spark/S3FileIO tests, strengthen Spark write-denial assertions to require `403 AccessDenied`, and add focused checks of Gravitino's generated inline STS policy: read-only sessions, object and bucket boundaries, both listing APIs, Hadoop's deliberate bare-prefix behavior, deletion, and multipart upload. Image index: `rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035`. Published `linux/amd64` and `linux/arm64` manifests were verified. ### Why are the changes needed? Move these tests beyond the MinIO image-availability workaround in #13112 while retaining their storage-authorization coverage. Related to #13154; automated image updates and vulnerability reporting are handled in a separate follow-up PR. ### Does this PR introduce _any_ user-facing change? No. This changes test infrastructure only. RustFS is a release candidate. These checks establish caller-plus-inline-policy enforcement, not AWS named-role trust or external-ID enforcement. The generated policy does not grant `AbortMultipartUpload`; the focused multipart test uses root credentials only to clean up unfinished uploads after failure. Further boundaries and commands are documented in [the fixture README](https://github.com/nevzheng/gravitino/blob/ffd21dd5ca8dedcca023731adb2aa5809889b566/integration-test-common/README-rustfs.md). ### How was this patch tested? On Corretto 17.0.19 and Docker 29.4/OrbStack with the pinned `linux/arm64` image: - Image-pin parsing: **2 passed**. - Signed STS policy and multipart probes: **5 passed**. - Spark/S3FileIO owner, modify, select-only, and active-role tests: **4 passed**. - Hadoop fileset catalog connection: **1 passed**. - Changed-module Spotless checks and `git diff --check` passed. Native Linux amd64 and deploy-mode execution remain for the existing backend CI matrix. This Mac's build-output redirection needed its documented compatibility switch because the existing catalog loader expects module-local `build/resources/main` paths. ```shell ./gradlew :catalogs:catalog-lakehouse-iceberg:jar \ :catalogs:catalog-fileset:jar :catalogs:hadoop-common:jar \ -DcentralBuildOutputs.disabled=true ./gradlew :integration-test-common:test \ --tests org.apache.gravitino.integration.test.container.TestRustFSContainer \ :catalogs:catalog-fileset:test \ --tests org.apache.gravitino.catalog.fileset.integration.test.FilesetS3TokenConnectionIT \ :iceberg:iceberg-rest-server:test \ --tests org.apache.gravitino.iceberg.integration.test.IcebergRESTRustFSTokenAuthorizationIT \ --tests org.apache.gravitino.iceberg.integration.test.RustFSS3TokenIT \ -PskipDockerTests=false -DcentralBuildOutputs.disabled=true ```
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Point
MinIOContainer.DEFAULT_IMAGEatquay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z. It's the same MinIO release, pulled from MinIO's quay.io organization instead of Docker Hub.Why are the changes needed?
Docker Hub removed the
minio/miniorepository, so every integration test that startsMinIOContainerfails withpull access denied. That includesFilesetS3TokenConnectionITin Backend Integration Test andIcebergRESTMinIOTokenAuthorizationIT. This is a temporary fix, the same one apache/iceberg#18071 and apache/doris#67897 merged. Replacing MinIO is tracked in the discussion on #13111.Fix: #13111
Does this PR introduce any user-facing change?
No. Test infrastructure only.
How was this patch tested?
docker pull minio/minio:RELEASE.2025-09-07T16-13-09Zfails withpull access denied;docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Zsucceeds../gradlew :integration-test-common:spotlessCheck :integration-test-common:compileTestJavapasses.FilesetS3TokenConnectionIT.