[HBASE-16700] Allow for coprocessor whitelisting

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Component/s: Coprocessors
• Labels: security
• Hadoop Flags: Reviewed
• Release Note: Provides ability to restrict table coprocessors based on HDFS path whitelist. (Particularly useful for allowing Phoenix coprocessors but not arbitrary user created coprocessors.)
• Assignee: Clay B.
• Reporter: Clay B.
• Created: 23/Sep/16 21:13
• Updated: 01/Jan/17 02:54
• Resolved: 05/Dec/16 22:47

Description

Today one can turn off all non-system coprocessors with hbase.coprocessor.user.enabled however, this disables very useful things like Apache Phoenix's coprocessors. Some tenants of a multi-user HBase may also need to run bespoke coprocessors. But as an operator I would not want wanton coprocessor usage. Ideally, one could do one of two things:

• Allow coprocessors defined in hbase-site.xml – this can only be administratively changed in most cases
• Allow coprocessors from table descriptors but only if the coprocessor is whitelisted