[HDFS-12357] Let NameNode to bypass external attribute provider for special user

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.9.0, 3.0.0-beta1
• Hadoop Flags: Reviewed
• Assignee: Yongjun Zhang
• Reporter: Yongjun Zhang
• Created: 25/Aug/17 20:40
• Updated: 08/Sep/17 16:15
• Resolved: 07/Sep/17 21:27

Description

This is a third proposal to solve the problem described in HDFS-12202.

The problem is, when we do distcp from one cluster to another (or within the same cluster), in addition to copying file data, we copy the metadata from source to target. If external attribute provider is enabled, the metadata may be read from the provider, thus provider data read from source may be saved to target HDFS.

We want to avoid saving metadata from external provider to HDFS, so we want to bypass external provider when doing the distcp (or hadoop fs -cp) operation.

Two alternative approaches were proposed earlier, one in HDFS-12202, the other in HDFS-12294. The proposal here is the third one.

The idea is, we introduce a new config, that specifies a special user (or a list of users), and let NN bypass external provider when the current user is a special user.

If we run applications as the special user that need data from external attribute provider, then it won't work. So the constraint on this approach is, the special users here should not run applications that need data from external provider.

Thanks asuresh for proposing this idea and chris.douglas, daryn, manojg for the discussions in the other jiras.

I'm creating this one to discuss further.

Issue Links

• breaks: HDFS-12404 Rename hdfs config authorization.provider.bypass.users to attributes.provider.bypass.users
• is related to: HDFS-12202 Provide new set of FileSystem API to bypass external attribute provider
• relates to: HDFS-12294 Let distcp to bypass external attribute provider when calling getFileStatus etc at source cluster