Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Why is global admin permissions necessary to create a snapshot of a table in a specific namespace?

Solved Go to solution

Why is global admin permissions necessary to create a snapshot of a table in a specific namespace?

Contributor

We recently started implementing HBase namespaces + ACLs and have run into an issue. According to the docs: http://hbase.apache.org/0.94/book/ops.snapshots.html:

14.8.7. Snapshots operations and ACLs
If you are using security with the AccessController Coprocessor (See Section 8.2, “Access Control”), only a global administrator can take, clone, or restore a snapshot, and these actions do not capture the ACL rights. This means that restoring a table preserves the ACL rights of the existing table, while cloning a table creates a new table that has no ACL rights until the administrator adds them.

Our application requires the ability to take a snapshot of a specific table, clone it, and then

Questions

  • Why does the snapshot mechanism require this high level access to function?
  • Is this something that will change over time or is this the design and it's being done this way for a specific purpose?
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: Why is global admin permissions necessary to create a snapshot of a table in a specific namespace?

Super Collaborator

ACLs were not part of the core hbase (implemented through coprocessor). We were adding to a core functionality knowledge about an external component (ACL).

There was the discussion about the meaning of restoring the acls that we snapshotted (see HBASE-11013).

Please consult with the following for up-to-date ACL:

http://hbase.apache.org/book.html#appendix_acl_matrix

We cannot allow any user to restore any snapshot otherwise you'll be able to see data that is not yours.

There is no ACL on snapshot to say "allow this user to restore/clone" the snapshot.

1 REPLY 1
Highlighted

Re: Why is global admin permissions necessary to create a snapshot of a table in a specific namespace?

Super Collaborator

ACLs were not part of the core hbase (implemented through coprocessor). We were adding to a core functionality knowledge about an external component (ACL).

There was the discussion about the meaning of restoring the acls that we snapshotted (see HBASE-11013).

Please consult with the following for up-to-date ACL:

http://hbase.apache.org/book.html#appendix_acl_matrix

We cannot allow any user to restore any snapshot otherwise you'll be able to see data that is not yours.

There is no ACL on snapshot to say "allow this user to restore/clone" the snapshot.

Don't have an account?
Coming from Hortonworks? Activate your account here