ACLs were not part of the core hbase (implemented through coprocessor). We were adding to a core functionality knowledge about an external component (ACL). There was the discussion about the meaning of restoring the acls that we snapshotted (see HBASE-11013). Please consult with the following for up-to-date ACL: http://hbase.apache.org/book.html#appendix_acl_matrix We cannot allow any user to restore any snapshot otherwise you'll be able to see data that is not yours. There is no ACL on snapshot to say "allow this user to restore/clone" the snapshot. ... View more

Found my own answer after Googling a bit more in Community Connections here: https://community.hortonworks.com/articles/14463/auth-to-local-rules-syntax.html. [n:string] Indicates a matching rule where n declares the number of expected components in the principal. Components are separated by a /, where a user account has one component (ambari-qa) and a service account has two components (nn/fqdn). The string value declares how to reformat the value to be used in the rest of the expression. The placeholders are as follows: $0 - realm $1 - 1st component $2 - 2nd component ... View more

It appears as though adding permissions on just the namespace is not sufficient for allowing a user access to the tables within it. I had to cascade the permissions to the tables themselves like so in an hbase shell: list.each {|t| grant 'our_apps_user','RWCXA',t} I did the above using the included hbase SPN in the hbase.headless.keytab. $ kinit -kt /etc/security/keytabs/hbase.headless.keytab hbase-<servername>@<REALM> $ hbase shell ...above command... ... View more

I was able to work around my issue by explicitly setting my hostname in /etc/hosts in addition to hostnamectl. I think when Ambari constructs the Kerberos principals it is using the hostname that would resolve for the IP address that's assigned to my box. Using the output from hostname -A lead me to a solution in addition to this snippet in Ambari Agent's log file: java.io.IOException: Login failure for dn/host-192-168-114-49.td.local@<REDACTED KERBEROS REALM> from keytab /etc/security/keytabs/dn.service.keytab: javax.security.auth.login.LoginException: Unable to obtain password from user Notice the hostname is thought to be host-192-168-114-49.td.local however in hostnamectl it's set to dev09-ost-hivetest-h-hb02.td.local. These being out of sync was ultimately my issue. I created this Jira in the Ambari project about this as well: https://issues.apache.org/jira/browse/AMBARI-15165 ... View more

It is not possible in Ambari, what you can do is load this one app into HBase on Yarn "Slider", there you can run multiple versions of HBase on top of Yarn. This will be a secondary HBase cluster. https://slider.incubator.apache.org/docs/examples.html ... View more