[AMBARI-13897] Ambari does not configure hbase.coprocessor.regionserver.classes

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.2.0
• Component/s: ambari-server
• Assignee: Jaimin Jetly
• Reporter: Jaimin Jetly
• Created: 14/Nov/15 05:26
• Updated: 16/Nov/15 22:09
• Resolved: 16/Nov/15 19:28

Description

In a newly installed cluster with security and ranger, I cannot find hbase.coprocessor.regionserver.classes configured which is needed to protect some of the direct RPC's to the regionserver (stopping regionserver is an example).

In a proper cluster all three properties should be configured:

<property>
  <name>hbase.coprocessor.region.classes</name>
  <value>org.apache.hadoop.hbase.security.token.TokenProvider, org.apache.hadoop.hbase.security.access.AccessController,org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint</value>
</property>
<property>
  <name>hbase.coprocessor.master.classes</name>
  <value>org.apache.hadoop.hbase.security.access.AccessController</value>
</property>
<property>
  <name>hbase.coprocessor.regionserver.classes</name>
  <value>org.apache.hadoop/hbase.security.access.AccessController</value>
</property>

In stackadvisor, I can see that we are configuring hbase.coprocessor.regionserver.classes, but somehow in a newly installed cluster, I don't find the setting in hbase-site.xml.

There are a couple of action items from this jira:

1. Make sure that hbase.coprocessor.regionserver.classes is configured properly for secure clusters.
2. reading the stackadvisor code, it can be improved so that if the customer has configured other coprocessors, they are not lost. The logic for hbase.coprocessor.regionserver.classes and hbase.coprocessor.region.classes and hbase.coprocessor.master.classes should be something like this:

• get the list of co-processors and put them to a set.
• If security is enabled, then add either ranger or hbase native AC coprocessors to the set
• Else remove the AC and ranger AC coprocessors from the list
• write the configurations to hbase-site.

Issue Links

• supercedes: AMBARI-11736 hbase.coprocessor.regionserver.classes should not be a required config for hbase
• links to: ReviewBoard