https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96382#M59708 <P>Could you confirm that from an operation point of view, i can add / remove coprocessor using the following process.</P><P>- Stop application relying on coprocessor </P><P>- Remove coprocessor from hbase-site</P><P>- Rolling / restart of master ( assuming HA master ) </P><P>- Rolling / restart of region server ( if we are using HA region server, we should not have any disruption of services ) </P> Mon, 02 Nov 2015 18:28:03 GMT orenault 2015-11-02T18:28:03Z https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96380#M59706 <P>Is there a way of restricting access to an HBase coprocessor in a multi tenant environment ? What should i be taking into consideration when using coprocessor ?</P> Mon, 02 Nov 2015 05:59:40 GMT https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96380#M59706 orenault 2015-11-02T05:59:40Z https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96381#M59707 <P>First thing to take into account when using a coprocessor is that they can break your hbase in case of error so this configuration can help you: hbase.coprocessor.abortonerror setting it to false will allow to still start your hbase cluster.</P><P>When you decide to use coprocessors:</P><P> - hbase.coprocessor.enabled: Enables or disables coprocessor loading, for master loading</P><P> - hbase.coprocessor.user.enabled: Enables or disables coprocessor loading from shell aka user loading in table creation.</P><P>- hbase.coprocessor.region.classes: A comma-separatedlist of Coprocessors that are loaded by</P><P>default on alltables</P><P>These settings set ground rules of how coprocessors can be used it might be a good decision to be restrictive in how they can be added.</P><P>Once we have looked at all of these a coprocessor is an extension of the Hbase cluster or table functionnalities so no extra security on top of the standard Hbase security. You are however allowed to put your own logic in the coprocessor if it makes sense. A coprocessor at a higher priority may preempt action by those at lower priority by throwing an IOException (or a subclass of this). The coprocessor blog has an example of an acces-control coprocessor: <A href="https://blogs.apache.org/hbase/entry/coprocessor_introduction" target="_blank">https://blogs.apache.org/hbase/entry/coprocessor_introduction</A>.</P><P>If you are enclined to build more access logic this is a good starting point.</P><P>hope this helps</P><P> </P> Mon, 02 Nov 2015 06:20:30 GMT https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96381#M59707 nmaillard1 2015-11-02T06:20:30Z https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96382#M59708 <P>Could you confirm that from an operation point of view, i can add / remove coprocessor using the following process.</P><P>- Stop application relying on coprocessor </P><P>- Remove coprocessor from hbase-site</P><P>- Rolling / restart of master ( assuming HA master ) </P><P>- Rolling / restart of region server ( if we are using HA region server, we should not have any disruption of services ) </P> Mon, 02 Nov 2015 18:28:03 GMT https://community.cloudera.com/t5/Support-Questions/HBase-Coprocessor-and-security/m-p/96382#M59708 orenault 2015-11-02T18:28:03Z