[AMBARI-16084] [RU] Hbase is losing table access permissions during upgrade.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.2
• Fix Version/s: 2.2.2
• Component/s: ambari-server
• Assignee: Dmitry Lysnichenko
• Reporter: Dmitry Lysnichenko
• Created: 24/Apr/16 18:52
• Updated: 25/Apr/16 19:29
• Resolved: 25/Apr/16 17:24

Description

So here's where we are:

• https://reviews.apache.org/r/45890/diff/2#index_header removed hard-coded python code which was trying to figure out which coprocessor to use. With these values gone, it's now up to Ambari to set the right value in the configurations.

• However, after removing the above code, we never change the ranger configurations to reflect the proper value

• To fix this, we need to fix the values on Ambari upgrade. When upgrading Ambari from 2.0, we'll need to do the following:
  • If Ranger is disabled; do nothing
  • If Ranger is enabled and the cluster's current stack is HDP 2.2, then set the master/region coprocessors to

    hbase_coprocessor_master_classes = "com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
    hbase_coprocessor_regionserver_classes = "com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
    hbase_coprocessor_region_classes = "org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint,com.xasecure.authorization.hbase.XaSecureAuthorizationCoprocessor"
    

  • If Ranger is enabled and the cluster's current stack is HDP 2.3, then set the master/region coprocessors to

    hbase_coprocessor_master_classes = "org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor "
    hbase_coprocessor_regionserver_classes = "org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor"
    hbase_coprocessor_region_classes = "org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint,org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor"
    

Now HDP stack upgrades will work since we look for XaSecureAuthorizationCoprocessor and change it to RangerAuthorizationCoprocessor as needed.

Issue Links

• links to: review_request_