Before 2.2, the global permission which storaged in zk is not right. It was storaged as a table permission. After
HBASE-21255, 2.2+ will read it as a global permission and will throw a cast error.
Before 2.2, the acl update logic is complicated. Client sent the grant/revoke rpc call to AccessControl coprocessor directly. And only the RS which has acl region will put a acl record to hbase:acl table. And the AccessControl override postPut/postDelete method, too. It will update zk when postPut/postDelete found this is a put/delete for acl region...And there is a TODO "global entry should be handled differently". The global entry was handled as a table permission, too.