ambari-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Dmitry Lysnichenko (JIRA)" <j...@apache.org>
Subject [jira] [Created] (AMBARI-16084) [RU] Hbase is losing table access permissions during upgrade.
Date Sun, 24 Apr 2016 18:53:12 GMT
Dmitry Lysnichenko created AMBARI-16084:
-------------------------------------------

             Summary: [RU] Hbase is losing table access permissions during upgrade.
                 Key: AMBARI-16084
                 URL: https://issues.apache.org/jira/browse/AMBARI-16084
             Project: Ambari
          Issue Type: Bug
            Reporter: Dmitry Lysnichenko
            Assignee: Dmitry Lysnichenko
         Attachments: AMBARI-16084.patch


So here's where we are:

- https://reviews.apache.org/r/45890/diff/2#index_header removed hard-coded python code which
was trying to figure out which coprocessor to use. With these values gone, it's now up to
Ambari to set the _right_ value in the configurations.

- However, after removing the above code, we never change the ranger configurations to reflect
the proper value

- To fix this, we need to fix the values on Ambari upgrade. When upgrading Ambari from 2.0,
we'll need to do the following:
-- If Ranger is disabled; do nothing
-- If Ranger is enabled and the cluster's current stack is HDP 2.2, then set the master/region
coprocessors to
{code}
hbase_coprocessor_master_classes = "com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
hbase_coprocessor_regionserver_classes = "com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
hbase_coprocessor_region_classes = "org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint,com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
{code}
-- If Ranger is enabled and the cluster's current stack is HDP 2.3, then set the master/region
coprocessors to
{code}
hbase_coprocessor_master_classes = "org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor
"
hbase_coprocessor_regionserver_classes = "org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor"
hbase_coprocessor_region_classes = "org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint,org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor"
{code}

Now HDP stack upgrades will work since we look for {{XaSecureAuthorizationCoprocessor}} and
change it to {{RangerAuthorizationCoprocessor}} as needed.





--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message