Skip to content

feat: Add Azure-based storage lock #17951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yihua merged 14 commits into from
Apr 18, 2026
+2,054 −6
Merged

feat: Add Azure-based storage lock #17951

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
38e4d44
Add hudi azure based storage lock
Jan 13, 2026
3189787
ADLS support for storage lock
Jan 20, 2026
43b35a0
Test schema add
Jan 20, 2026
24d8406
Merge changes in two branches
Feb 11, 2026
df7054b
Address review comments. Relable ADLS to Azure Storage. Fix etag fetc…
Feb 24, 2026
2d956dc
Revert hive parquet version and added comments for SAS token
Feb 25, 2026
8286468
Address review comments. Add explicity configs for credential types.
Mar 9, 2026
598acc4
Change default credentials to holder pattern for lazy init and config…
Mar 28, 2026
637a857
Add review comments. explicit exceptions and address incosistent quot…
Mar 30, 2026
2ef504f
Revert parquet version
chrevanthreddy Apr 15, 2026
2992185
Remove unused variable
yihua Apr 17, 2026
7bd19f0
Address nits
yihua Apr 17, 2026
4107d19
Add more test coverage
yihua Apr 17, 2026
d2d7cb2
Fix checkstyle
yihua Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
240 changes: 240 additions & 0 deletions hudi-azure/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,240 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<parent>
<artifactId>hudi</artifactId>
<groupId>org.apache.hudi</groupId>
<version>1.2.0-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>

<modelVersion>4.0.0</modelVersion>
<artifactId>hudi-azure</artifactId>
<packaging>jar</packaging>

<properties>
<!-- Azure SDK versions are intentionally pinned here to keep this module self-contained. -->
<azure.storage.blob.version>12.26.0</azure.storage.blob.version>
<azure.identity.version>1.12.2</azure.identity.version>
<!-- Keep Jackson consistent for Azure SDK integration tests (Hudi core pins older Jackson versions). -->
<azure.jackson.version>2.13.5</azure.jackson.version>
Comment thread
yihua marked this conversation as resolved.
</properties>

<dependencies>
<!-- Logging -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
</dependency>

<!-- Lombok -->
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>

<!-- Hoodie -->
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-client-common</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-common</artifactId>
<version>${project.version}</version>
</dependency>

<!-- Hadoop (needed by shared test utilities / configs, consistent with hudi-gcp) -->
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-common</artifactId>
<scope>test</scope>
</dependency>

<!-- Azure SDK (Blob + DefaultAzureCredential) -->
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-storage-blob</artifactId>
<version>${azure.storage.blob.version}</version>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-identity</artifactId>
<version>${azure.identity.version}</version>
</dependency>

<!-- Test -->
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-tests-common</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-client-common</artifactId>
<version>${project.version}</version>
<classifier>tests</classifier>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-hadoop-common</artifactId>
<version>${project.version}</version>
<scope>test</scope>
<type>test-jar</type>
</dependency>
<dependency>
<groupId>org.apache.hudi</groupId>
<artifactId>hudi-common</artifactId>
<version>${project.version}</version>
<classifier>tests</classifier>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
<!-- Azure SDK requires a consistent Jackson stack for XML support; override for tests -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>${azure.jackson.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>${azure.jackson.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${azure.jackson.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
<version>${azure.jackson.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
<version>${azure.jackson.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
<version>${testcontainers.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>junit-jupiter</artifactId>
<version>${testcontainers.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.esotericsoftware</groupId>
<artifactId>kryo-shaded</artifactId>
<scope>test</scope>
</dependency>
</dependencies>

<profiles>
<profile>
<id>azure-integration-tests</id>
Comment thread
yihua marked this conversation as resolved.
<build>
<plugins>
<!-- Skip unit tests; run ITs via failsafe -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<skip>true</skip>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<version>${maven-failsafe-plugin.version}</version>
<configuration>
<includes>
<include>**/IT*.java</include>
</includes>
</configuration>
<executions>
<execution>
<phase>integration-test</phase>
<goals>
<goal>integration-test</goal>
</goals>
</execution>
<execution>
<id>verify-integration-test</id>
<phase>verify</phase>
<goals>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>

<build>
<resources>
<resource>
<directory>src/main/resources</directory>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.rat</groupId>
<artifactId>apache-rat-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>${maven-jar-plugin.version}</version>
<executions>
<execution>
<goals>
<goal>test-jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>

94 changes: 94 additions & 0 deletions hudi-azure/src/main/java/org/apache/hudi/azure/credentials/AzureCredentialFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package org.apache.hudi.azure.credentials;

import org.apache.hudi.config.AzureStorageLockConfig;

import com.azure.core.credential.TokenCredential;
import com.azure.identity.ClientSecretCredentialBuilder;
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.identity.ManagedIdentityCredentialBuilder;

import java.util.Properties;

import static org.apache.hudi.common.util.ConfigUtils.getStringWithAltKeys;

/**
* Factory for resolving an Azure {@link TokenCredential} from Hudi properties.
*
* <p>Credential precedence:
* <ol>
* <li>User-assigned managed identity ({@link AzureStorageLockConfig#AZURE_MANAGED_IDENTITY_CLIENT_ID})
* — uses {@code ManagedIdentityCredential}</li>
* <li>Service principal ({@link AzureStorageLockConfig#AZURE_CLIENT_TENANT_ID} +
* {@link AzureStorageLockConfig#AZURE_CLIENT_ID} +
* {@link AzureStorageLockConfig#AZURE_CLIENT_SECRET})
* — uses {@code ClientSecretCredential}</li>
* <li>{@code DefaultAzureCredential} — (system-assigned MI,
* workload identity, env-var SP, Azure CLI, etc.); suitable for dev and environments
* where auth is controlled externally</li>
* </ol>
*
* <p>Note: connection string and SAS token auth are not {@link TokenCredential}-based and are
* handled directly by the caller before this factory is consulted.
*/
public class AzureCredentialFactory {

/**
* Lazily initializes {@code DefaultAzureCredential} on first use of the default chain only.
*/
private static final class DefaultAzureCredentialHolder {
static final TokenCredential INSTANCE = new DefaultAzureCredentialBuilder().build();
}

Comment thread
yihua marked this conversation as resolved.
private AzureCredentialFactory() {
}

/**
* Returns a {@link TokenCredential} resolved from the supplied properties.
*
* @param props Hudi lock properties
* @return resolved credential, never {@code null}
*/
public static TokenCredential getAzureCredential(Properties props) {
if (props != null) {
String miClientId = getStringWithAltKeys(props, AzureStorageLockConfig.AZURE_MANAGED_IDENTITY_CLIENT_ID, true);
if (miClientId != null && !miClientId.trim().isEmpty()) {
return new ManagedIdentityCredentialBuilder()
.clientId(miClientId)
.build();
}

String tenantId = getStringWithAltKeys(props, AzureStorageLockConfig.AZURE_CLIENT_TENANT_ID, true);
String clientId = getStringWithAltKeys(props, AzureStorageLockConfig.AZURE_CLIENT_ID, true);
String clientSecret = getStringWithAltKeys(props, AzureStorageLockConfig.AZURE_CLIENT_SECRET, true);
if (tenantId != null && !tenantId.trim().isEmpty()
&& clientId != null && !clientId.trim().isEmpty()
&& clientSecret != null && !clientSecret.trim().isEmpty()) {
return new ClientSecretCredentialBuilder()
.tenantId(tenantId)
.clientId(clientId)
.clientSecret(clientSecret)
.build();
}
}

return DefaultAzureCredentialHolder.INSTANCE;
}
}
Loading
Loading