[HBASE-24121] [Authorization] ServiceAuthorizationManager isn't dynamically updatable. And it should be.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0, 1.7.0, 1.4.14, 2.2.5
• Component/s: rpc, security
• Hadoop Flags: Reviewed

Release Note

Master & RegionService now support refresh policy authorization defined in hbase-policy.xml without restarting service. To refresh policy, please execute hbase shell command: update_config or update_config_all after policy file updated and synced on all nodes.

• Assignee: Reid Chan
• Reporter: Reid Chan
• Created: 06/Apr/20 08:42
• Updated: 10/Apr/20 11:31
• Resolved: 09/Apr/20 10:03

Description

Some more background information.

ServiceAuthorizationManager is responsible for the Services access rights defined in hbase-policy.xml which locates under $hbase_home/conf directory.

Currently, since it doesn't support update dynamically, we need to restart master/regionservers to make configurations take effect. It is an expensive and low efficient admin operation.

HDFS has the refreshPolicy to do that, HBase also has update_config command, we can make use of that.

Issue Links

• links to: GitHub Pull Request #1439