Fixed issues

Fixed issues in Cloudera Data Warehouse on cloud

DWX-23542: Environment activation is blocked in the UI when the validation API reports errors

When you attempted to activate an environment in the Cloudera Data Warehouse UI, the Activate Environment option was not displayed if the validation API call returned an error message. This occurred because the UI treated validation API results as blocking errors rather than informational guidance, preventing users from completing environment activation.

This issue is now resolved.

DWX-24246, DWX-24227: Environment activation and deactivation failures due to missing IAM permissions in restricted and reduced policy modes

Previously, in Cloudera Data Warehouse environments using restricted policy modes, environment lifecycle operations failed due to missing AWS IAM permissions in the policy templates. Environment deactivation failed and entered a DELETE_FAILED status, causing the environment to transition to Bad Health, because AWS CloudFormation's updated resource provider framework requires the elasticfilesystem:DescribeReplicationConfigurations permission during EFS teardown, which was missing from the restricted policy template (restricted-policy-managedARN-2.json5). Additionally, post CloudFormation environment activation failed with an AccessDeniedException because direct AWS SDK calls to eks:DescribeCluster were missing from direct call policy statement, specifically in gocodeEks for reduced permissions mode and gocodeEKSCluster for restricted policy mode, having only been present in CloudFormation scoped statements.

This issue is now fixed. The elasticfilesystem:DescribeReplicationConfigurations permission andeks:DescribeCluster permission are now included in the corresponding IAM policy statements in the cdw-cloud-policies repository.

DWX-24007: Cloudera Data Warehouse fails to activate in AWS environments with strict tag policies

Previously, environment tags were added to EC2 instances only after they were created. Because tags were missing during creation, activation failed in AWS accounts that strictly require tags at launch.

This issue is now fixed. Tags are now included directly in the CloudFormation launch templates. As a result, EC2 instances, root EBS volumes, and primary ENIs are properly tagged from the moment they are created.

Fixed issues in Hive on Cloudera Data Warehouse on cloud

CDPD-110246: Submitting a large DAG fails when a session outlives its client

When a Tez session stayed active longer than the client that created it, submitting a large DAG on that session failed with a FileAlreadyExistsException error.

This issue is now resolved. Tez no longer reuses conflicting staging file names, so you can submit large DAGs on a session even after it outlives the original client.

Apache Jira: TEZ-4737

CDPD-121752: IndexOutOfBoundsException when WHERE clause contains subqueries and correlated conditions

In queries where the WHERE clause contains IN or EXISTS subqueries along with correlated conditions, an unexpected error occurred, causing the query to throw an exception.

This issue is now resolved by correcting the handling of subquery conditions in the planner.

Apache Jira: HIVE-29688, HIVE-29357

CDPD-66731: Hive Metastore query failure during Zero Downtime Upgrade

Previously, during a Zero Downtime Upgrade (ZDU) from version 7.2.17 to 7.2.18, long-running queries such as INSERT INTO statements failed with a MetaException.

This issue is now fixed by ensuring that transaction blocks are correctly managed during the statistics update task, preventing the "current transaction is aborted" error.

CDPD-95582: Compaction cleanup failed with a PostgreSQL data type error

Previously, when Hive used a PostgreSQL-backed metastore, transaction compaction cleanup could fail with a PostgreSQL error such as "could not determine data type of parameter $4" because a compaction cleanup query passed a NULL parameter without an explicit SQL type.

This issue is resolved by explicitly casting the NULL parameters in the compaction cleanup query to their appropriate SQL types, so compaction cleanup no longer fails against a PostgreSQL-backed metastore.

Apache Jira: HIVE-29318

CDPD-88849: Self-join queries failed with an ambiguous table alias error

Previously, a query that joined the same table with itself more than twice, including through views or common table expressions, failed during compilation with an "Ambiguous table alias" error, even though the aliases used were valid.

This issue is resolved by improving semantic analysis to correctly distinguish between multiple instances of the same table in a self-join query.

Apache Jira: HIVE-28222

Fixed issues in Cloudera Data Explorer (Hue) on Cloudera Data Warehouse on cloud

CDPD-23994: Table browser error due to mixed data type columns in Data Explorer

Previously, the table page in Data Explorer displayed a ‘<’ not supported between instances of 'str' and 'int''comparison error. This occurred within the Autocomplete and Describe APIs when columns contained mixed data types, which caused sorting and description operations to fail when both strings and integers were present. This issue is now fixed by correcting how the Autocomplete and Describe APIs handle and sort mixed data types, ensuring that the table page displays correctly without errors.

CDPD-82506: Single-column CSV import failure in Data Explorer

Previously, importing a CSV file containing only a single column in Data Explorer failed during the file format detection step. This prevented the data preview from displaying and disabled the submission process. This issue is resolved by improving file format parsing and field name inference for single-column CSV files.

CDPD-100816: Data Explorer File Browser workflow submission button failure

Previously, the Submit button component in the Data Explorer File Browser application failed to function, which prevented submitting workflows. This issue is now fixed by restoring the required path reference dependency.

CDPD-68779: Error while browsing S3 buckets or ADLS containers from the left-assist panel

Previously, when attempting to browse S3 buckets or ADLS containers from the left-assist panel in Data Explorer without the required permissions, the system displayed a generic error message: Failed to retrieve buckets:1:0: syntax error. This issue is now fixed. When RAZ is enabled, the left-assist panel now opens the home directory if the required permissions are available. In non-RAZ environments, the left-assist panel opens the path configured in the Data Explorer configuration file.

DWX-24136: Trino query failure in Data Explorer

Previously, running Trino queries in Data Explorer failed with a "cannot use authentication with HTTP" error on shared Virtual Warehouse instances. This issue occurred because service discovery fallback mechanisms built an incorrect Trino coordinator URL, which omitted required authentication credentials. This issue is now resolved.

Fixed issues in Impala on Cloudera Data Warehouse on cloud

CDPD-107170: AI endpoint validation could allow URLs that were not from an allowed provider

Previously, Cloudera AI checked allowed AI endpoints by looking for the allowed domain anywhere in the URL. As a result, a URL that contained an allowed domain only in its path or query parameters could pass validation, even when its actual hostname was not from an allowed provider.

This issue is resolved by updating URL validation for AI endpoints in Impala. While Impala already restricted requests to an allow list of providers, the validation now uses a stricter exact hostname parsing rather than a simple substring match. This change reduces edge cases where allowed domain strings hidden in URL paths or parameters might bypass the policy.

CDPD-106242: Server-side request forgery and unauthorized schema access through Avro schema URL

Previously, specifying a URL in the avro.schema.url table property made unrestricted HTTP requests and exposed raw file or HTTP response details in error messages.

This issue is resolved by disabling remote HTTP requests by default for the avro.schema.url table property in Impala. If required, you can enable remote HTTP requests by using the avro_schema_url_remote_http_enabled and avro_schema_url_http_allowed_hosts configuration properties.

CDPD-106242: Uncontrolled remote HTTP requests in Avro schema URLs

Previously, processing avro.schema.url properties allowed connections to arbitrary external hosts and allowed remote file reads without system controls.

This issue is resolved by adding Ranger read permission checks for filesystem paths in Impala. Previously, requests using local filesystem schemes, such as local:// or hdfs://, in the avro.schema.url table property were unguarded and allowed unauthorized file reads without proper access controls. The allowed schemas can also now be controlled with avro_schema_url_allowed_schemes.

Fixed issues in Iceberg on Cloudera Data Warehouse on cloud

There are no fixed issues in this release.

Fixed issues in Trino on Cloudera Data Warehouse on cloud

DWX-24070: Unintended injection of default Data Lake configurations blocks creation of external Iceberg and Hive connectors

Previously, in Cloudera Data Warehouse, creating a new Iceberg or Hive connector always automatically injected default Data Lake configurations, such as Ranger policies and Kerberos settings. These default configurations are only required for the default Hive or Iceberg connector created during Virtual Warehouse creation to access the default Data Lake. When creating a connector to an external metastore, such as when using an Iceberg REST catalog or Delta Lake integration, these hardcoded defaults could not be bypassed, preventing the creation of REST-based or external catalog connectors.

This issue is now resolved. Creating custom or external Iceberg and Hive connectors no longer includes default Data Lake configurations, enabling custom metastore and catalog setups.

DWX-23907: Trino queries fail intermittently when reading data from Azure Blob File System (ABFS) storage

Previously, Trino queries failed intermittently with errors such as Error opening split, Azure service error reading file, or Azure service error fetching properties for file. This occurred due to an Azure token throttling issue within the Trino runtime.

This issue is now fixed.