Mailing-List: contact user-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hbase.apache.org
Received-SPF: pass (athena.apache.org: domain of esteban@cloudera.com
 designates 209.85.217.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CALU28N4qJWe1o+1vxa6cTPPvHzB9SWAsQuvRt7QcGJP-H52UdQ@mail.gmail.com>
References: 
 <CALU28N4qJWe1o+1vxa6cTPPvHzB9SWAsQuvRt7QcGJP-H52UdQ@mail.gmail.com>
From: Esteban Gutierrez <esteban@cloudera.com>
Date: Fri, 19 Dec 2014 23:42:06 -0800
Message-ID: 
 <CALPvCiAtW+2c4T3HGHJaP_t=cHDaieSR10eP_yUXjFV_PYaZcw@mail.gmail.com>
Subject: Re: ACLs/Quotas for HBase structures
To: "user@hbase.apache.org" <user@hbase.apache.org>
Content-Type: multipart/alternative; boundary=001a11349ff8404b88050aa0f7f6

--001a11349ff8404b88050aa0f7f6
Content-Type: text/plain; charset=UTF-8

Hello Manoj,

Thats a very interesting requirement, unfortunately the existing HBase
directory structure needs to be owned by the user that started HBase
(usually the 'hbase' user) and HBase will handle all the permissions and
ACL rules without exposing details from HDFS to the client API. Even if you
change the ownership of Hfiles under a specific namespace or table,
compactions or splits will create new files as the HBase superuser. Also,
running multiple HBase clusters under the same HDFS cluster to go around
this limitation should be avoided since it can make things really hard to
manage.

Regarding the quota requirement, probably HBASE-8410/HBASE-11999 (work in
progress) will be the best option in order to support quotas in a reliable
way. Keep in mind that using HDFS quotas with HBase doesn't work well since
compactions and splits can increase the space utilization beyond the quota
sometimes and that could trigger failures in the Region Servers.

Probably your only option for now is to monitor the namespace utilization,
use Kerberos for authentication and specify a set of ACL rules that will
guarantee that users cannot access namespaces that are not allowed to.

cheers,
esteban.


--
Cloudera, Inc.


On Fri, Dec 19, 2014 at 10:31 PM, Manoj Murumkar <manoj.murumkar@gmail.com>
wrote:
>
> Folks,
>
> We are trying to control space usage and manage security at HBase namespace
> level. Think of it in terms of a RDBMS (database and superuser for a
> database). Is there a simple way to do this?
>
> This is what I have in mind. Does it make sense?
>
>
>    - Space quotas: Namespace is managed under
> /apps/hbase/data/data/<namespace>
>    directory. We'll  use "dfsadmin -setQuota" to set appropriate quotas.
>    - Make <superuser> owner of /apps/hbase/data/data/<namespace> directory
>    in hdfs.
>
>
> Thanks for any pointers from folks who have done this kind of thing.
> Appreciate the time.
>
> Manoj
>

--001a11349ff8404b88050aa0f7f6--