Repository navigation
revert(lcm): Revert Redshift JDBC 2.2.9 and CentOS base image - #2117
milandufek wants to merge 1 commit into
Conversation
Revert #2115 and #2114 and release the result as 3.7.110. With redshift-jdbc42 2.2.9 the driver ignores the UID property that redshift_client.rb sets: Driver.loadDefaultProperties() defaults "user" to the JVM user.name and Driver.user() reads UID only when "user" is null. Every basic-auth Redshift connection therefore logs in as the container user "apache". The users brick on na3 has failed hourly with "password authentication failed for user apache" since 08:30Z. The tree matches the 3.7.108 release (Fedora base image and redshift-jdbc42-no-awssdk 1.2.36.1060). VERSION is bumped to 3.7.110 instead of restored to 3.7.108, because images are tagged with VERSION and 3.7.108 already exists. JIRA: GRIF-1221
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Image configuration and release version Dockerfile, DockerfileOldImage, VERSION |
Both Dockerfiles use the Java 11 JRE image tagged 202609300803.5ae07065-f44 and update the parent_image label. Package installation adds gawk and bzip2; DockerfileOldImage also adds gnupg. VERSION changes from 3.7.109 to 3.7.110. |
Redshift JDBC dependencies
| Layer / File(s) | Summary |
|---|---|
JDBC and AWS SDK dependency set ci/redshift/pom.xml |
The Redshift JDBC dependency changes to redshift-jdbc42-no-awssdk version 1.2.36.1060. AWS SDK v2 and Jackson Databind dependencies are removed. AWS SDK v1 Core, Redshift, and STS dependencies are added at version 1.11.633. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Possibly related PRs
- gooddata/gooddata-ruby#2113: Updates the Java 11 base image tag in the same Dockerfiles.
- gooddata/gooddata-ruby#2114: Changes both Dockerfiles from Fedora Java 11 to CentOS 9 Java 11; this PR returns them to the Java 11 image configuration.
- gooddata/gooddata-ruby#2115: Upgrades the Redshift JDBC dependency and removes AWS SDK v1 dependencies.
Suggested reviewers: hung-nguyen-hoang
Merge Risk: 
e43db
-
This change reverts the JDBC and base image upgrades that broke basic-authentication Redshift connections and releases the result as 3.7.110. No concrete merge-blocking defect was found. After merge, confirm the new image digest and run the Redshift brick to validate it.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the two main changes: reverting the Redshift JDBC 2.2.9 dependency and reverting the CentOS base image change. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the image tag,
Then packs new tools into its bag.
The JDBC names rearrange,
While SDK versions change.
The version hops one step ahead,
And carrots wait beside the build.
Comment @coderabbitai help to get the list of available commands.
Jira: GRIF-1221
Why
LCM bricks that read from Redshift with basic authentication fail with
FATAL: password authentication failed for user "apache"since 3.7.109 (#2115) was promoted tostable/lcm-bricks:latestandstable/lcm-bricks-nextversion:latest.Brick pods pull
:latest, so every DC runs the new image. The users brick on na3 has failed on every hourly run since 08:30Z.Cause
redshift-jdbc422.2.9 ignores theUIDproperty thatredshift_client.rbsets:Driver.loadDefaultProperties()defaultsuserto the JVMuser.name.connect()layers the caller's properties over those defaults.Driver.user()readsuserfirst and readsUIDonly ifuseris null.useris never null, soUIDis never used. Every basic-auth connection logs in as the container userapachewith the configured password.This was read from the bytecode of the 2.2.9 jar (checksum matches Maven Central). A live connection test was not run.
The 1.2.36 driver used before has no such default.
What
redshift-jdbc422.2.9).VERSIONto3.7.110. Do not restore3.7.108: images are tagged withVERSION, and3.7.108already exists.The tree is identical to the 3.7.108 release (
git diff 3da85bf8 HEADshows onlyVERSION).That is the combination that ran in production until 3.7.109.
Rollout
The merge queue builds both images and moves
:latestinpromote-to-stable. Brick pods pull the new image on their next start.No re-registration of the LCM components is needed for the fix. The registration points at
:latestand stores only descriptive metadata such as the version.Verify after the merge
lcm-brickpods run a new image digest.Realize SQL query: type=redshift status=finished.Risks
userandpasswordto be set inredshift_client.rband a test against a real Redshift. The e2e job has no Redshift configuration, so it cannot catch this.🤖 Generated with Claude Code
Summary by CodeRabbit