test: refresh permissions between table creation - #4892
Merged
Conversation
TestRestoreFullChangingMethodIntegration behaved flaky recently. Even though a few initial restore table could succeed, it could fail on the last one on permissions' error. In this test, we drop and re-create the tables constantly. This also drops their permissions configuration. The test worked because the same user also re-created those tables and was granted all their permissions by default. It might be that such permissions are not instantly propagated to all other nodes and depending on which node the alter schema query is routed to, the test might fail. To fix that, we could either make an explicit raft read barrier on all nodes, or just re-apply the needed permissions, as explicit permissions changes also result in raft read barrier being performed underneath. I chose the second approach, because it requires only a single API call and is more explicit in terms of what permissions are expected from the restore user instead of relying on the default permissions granted on schema restore.
There was a problem hiding this comment.
Pull request overview
Refreshes restore-user permissions after each schema recreation to prevent flaky permission failures.
Changes:
- Moves table permission grants into each restore iteration.
- Applies permissions immediately before restoring table data.
Integration-test requirements remain satisfied; coverage is not reduced. No user-facing documentation changes are needed.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Michal-Leszczynski
marked this pull request as ready for review
July 28, 2026 12:58
Michal-Leszczynski
requested review from
VAveryanov8 and
karol-kokoszka
as code owners
July 28, 2026 12:58
karol-kokoszka
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TestRestoreFullChangingMethodIntegrationbehaved flaky recently. Even though a few initial restore table could succeed, it could fail on the last one on permissions' error.In this test, we drop and re-create the tables constantly. This also drops their permissions configuration.
The test worked because the same user also re-created those tables and was granted all their permissions by default. It might be that such permissions are not instantly propagated to all other nodes and depending on which node the alter schema query is routed to, the test might fail.
To fix that, we could either make an explicit raft read barrier on all nodes, or just re-apply the needed permissions, as explicit permissions changes also result in raft read barrier being performed underneath. I chose the second approach, because it requires only a single API call and is more explicit in terms of what permissions are expected from the restore user instead of relying on the default permissions granted on schema restore.
Fixes https://scylladb.atlassian.net/browse/CLOUD-3264