HPCC-33710 Add engine Sasha access support

Signed-off-by: Jake Smith <[email protected]>

Author: jakesmith

common/thorhelper/enginecontext.hpp

@@ -43,6 +43,7 @@ interface IEngineContext
     virtual StringBuffer &getQueryId(StringBuffer &result, bool isShared) const = 0;
     virtual void onTermination(QueryTermCallback callback, const char *key, bool isShared) const = 0;
     virtual void getManifestFiles(const char *type, StringArray &files) const = 0;
+    virtual bool allowSashaAccess() const = 0;
 };
 
 #endif // ENGINECONTEXT_HPP

ecl/eclagent/eclagent.ipp

@@ -566,6 +566,7 @@ public:
         return ::getGlobalUniqueIds(num, &foreignNode);
     }
     virtual bool allowDaliAccess() const  { return true; }
+    virtual bool allowSashaAccess() const { return true; }
     virtual StringBuffer &getQueryId(StringBuffer &result, bool isShared) const
     {
         result.append("workunit"); // No distinction between global, workunit and query scopes for eclagent

helm/hpcc/templates/eclagent.yaml

@@ -61,6 +61,7 @@ data:
           labels:
             {{- include "hpcc.addStandardLabels" (dict "root" $ "component" $apptype "name" "eclagent" "instance" $appJobName "instanceOf" (printf "%s-job" .me.name)) | indent 12 }}
             accessDali: "yes"
+            accessSasha: "yes"
             accessEsp: "yes"
             {{- include "hpcc.generateHelmVersion" . | nindent 12 }}
 {{- if hasKey .me "labels" }}
@@ -138,6 +139,7 @@ spec:
         {{- include "hpcc.addStandardLabels" (dict "root" $ "component" $apptype "name" "eclagent" "instance" .name) | indent 8 }}
         run: {{ .name | quote }}
         accessDali: "yes"
+        accessSasha: {{ .useChildProcesses | default false | ternary "yes" "no" | quote }}
         accessEsp: {{ .useChildProcesses | default false | ternary "yes" "no" | quote }}
         {{- include "hpcc.generateHelmVersion" . | nindent 8 }}
 {{- if hasKey . "labels" }}

helm/hpcc/templates/thor.yaml

@@ -87,6 +87,7 @@ data:
         metadata:
           labels:
             accessDali: "yes"
+            accessSasha: "yes"
             accessEsp: "yes"
             {{- include "hpcc.generateHelmVersion" . | nindent 12 }}
             {{- include "hpcc.addStandardLabels" (dict "root" $ "component" "eclagent" "name" "thor" "instance" $eclAgentJobName "instanceOf" (printf "%s-job" .eclAgentName)) | indent 12 }}
@@ -217,6 +218,7 @@ data:
         metadata:
           labels:
             accessDali: "yes"
+            accessSasha: "yes"
             accessEsp: "yes"
             app: "thor"
             component: "thorworker"
@@ -351,6 +353,7 @@ spec:
     metadata:
       labels:
         accessDali: "yes"
+        accessSasha: {{ $commonCtx.eclAgentUseChildProcesses | ternary "yes" "no" | quote }}
         accessEsp: {{ $commonCtx.eclAgentUseChildProcesses | ternary "yes" "no" | quote }}
         app: "thor"
         component: "thor-eclagent"

plugins/workunitservices/workunitservices.cpp

@@ -179,8 +179,16 @@ namespace nsWorkunitservices {
 IPluginContext * parentCtx = NULL;
 
 
-static void getSashaWUArchiveNodes(SocketEndpointArray &epa)
+static void getSashaWUArchiveNodes(SocketEndpointArray &epa, ICodeContext *ctx)
 {
+    IEngineContext *engineCtx = ctx->queryEngineContext();
+    if (engineCtx && !engineCtx->allowSashaAccess())
+    {
+        Owned<IException> e = makeStringException(-1, "workunitservices cannot access Sasha in this context - this normally means it is being called from a thor worker");
+        EXCLOG(e, NULL);
+        throw e.getClear();
+    }
+
 #ifdef _CONTAINERIZED
     StringBuffer service;
     getService(service, "wu-archiver", true);
@@ -206,7 +214,7 @@ static IWorkUnitFactory * getWorkunitFactory(ICodeContext * ctx)
     IEngineContext *engineCtx = ctx->queryEngineContext();
     if (engineCtx && !engineCtx->allowDaliAccess())
     {
-        Owned<IException> e = MakeStringException(-1, "workunitservices cannot access Dali in this context - this normally means it is being called from a thor slave");
+        Owned<IException> e = MakeStringException(-1, "workunitservices cannot access Dali in this context - this normally means it is being called from a thor worker");
         EXCLOG(e, NULL);
         throw e.getClear();
     }
@@ -368,7 +376,7 @@ WORKUNITSERVICES_API void wsWorkunitList(
     MemoryBuffer mb;
     if (archived) {
         SocketEndpointArray sashaeps;
-        getSashaWUArchiveNodes(sashaeps);
+        getSashaWUArchiveNodes(sashaeps, ctx);
         ForEachItemIn(i,sashaeps) {
             Owned<ISashaCommand> cmd = createSashaCommand();    
             cmd->setAction(SCA_WORKUNIT_SERVICES_GET);                          
@@ -500,7 +508,7 @@ WORKUNITSERVICES_API bool wsWorkunitExists(ICodeContext *ctx, const char *wuid,
     if (archived)
     {
         SocketEndpointArray sashaeps;
-        getSashaWUArchiveNodes(sashaeps);
+        getSashaWUArchiveNodes(sashaeps, ctx);
         ForEachItemIn(i,sashaeps) {
             Owned<ISashaCommand> cmd = createSashaCommand();    
             cmd->setAction(SCA_LIST);                           

roxie/ccd/ccdcontext.cpp

@@ -3076,6 +3076,10 @@ class CRoxieServerContext : public CRoxieContextBase, implements IRoxieServerCon
         Owned<IRoxieDaliHelper> dali = ::connectToDali();
         return dali != nullptr;
     }
+    virtual bool allowSashaAccess() const
+    {
+        return nullptr != workUnit; // allow if dynamic query only
+    }
     virtual StringBuffer &getQueryId(StringBuffer &result, bool isShared) const
     {
         if (workUnit)

thorlcr/graph/thgraphslave.cpp

@@ -1662,7 +1662,13 @@ class CThorCodeContextSlave : public CThorCodeContextBase, implements IEngineCon
     virtual bool allowDaliAccess() const
     {
         // NB. includes access to foreign Dalis.
-        return jobChannel.queryJob().getOptBool("slaveDaliClient");
+        // slaveDaliClient option deprecated, but maintained for compatibility
+        return jobChannel.queryJob().getOptBool("allowDaliAccess", jobChannel.queryJob().getOptBool("slaveDaliClient"));
+    }
+    virtual bool allowSashaAccess() const
+    {
+        bool defaultAccess = isContainerized() ? false : true; // BM had access before, but not sure it should - kept for backwards compatibility
+        return jobChannel.queryJob().getOptBool("allowSashaAccess", defaultAccess);
     }
     virtual StringBuffer &getQueryId(StringBuffer &result, bool isShared) const
     {