[HBASE-18659] Use HDFS ACL to give user the ability to read snapshot directly on HDFS

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0
• Assignee: Yi Mei
• Reporter: Duo Zhang
• Created: 23/Aug/17 02:37
• Updated: 15/Jul/20 11:00
• Resolved: 12/Jun/20 15:44

Description

On the dev meetup notes in Shenzhen after HBaseCon Asia, there is a topic about the permission to read hfiles on HDFS directly.

For client-side scanner going against hfiles directly; is there a means of being able to pass the permissions from hbase to hdfs?

And at Xiaomi we also face the same problem. SnapshotScanner is much faster and consumes less resources, but only super use has the ability to read hfile directly on HDFS.

So here we want to use HDFS ACL to address this problem.

https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html#ACLs_File_System_API

The basic idea is to set acl and default acl on the ns/table/cf directory on HDFS for the users who have the permission to read the table on HBase.

Suggestions are welcomed.

Issue Links

• relates to: HBASE-22579 Add a tool to sync HBase permission and HDFS acls when enable user scan snapshot feature
• links to: Design Doc

Sub-Tasks

• Skip replay WAL and update seqid when open regions restored from snapshot: Resolved
• Add a coprocessor to set HDFS ACL for hbase granted user: Resolved
• HFileCleaner should not delete empty ns/table directories used for user san snapshot feature: Resolved
• Add a table attribute to make user scan snapshot feature configurable for table: Resolved
• documet use scan snapshot feature: Resolved
• Rename config names in user scan snapshot feature: Resolved
• Tmp directory should not be deleted when master restart used for user scan snapshot feature: Resolved