[HBASE-26204] VerifyReplication should obtain token for peerQuorumAddress too

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-alpha-1, 2.3.6, 2.4.5
• Fix Version/s: 2.5.0, 3.0.0-alpha-2, 2.4.6, 2.3.7
• Release Note: VerifyReplication obtains tokens even if the peer quorum parameter is used. VerifyReplication with peer quorum can be used for secure clusters also.
• Assignee: Shinya Yoshida
• Reporter: Shinya Yoshida
• Created: 17/Aug/21 08:42
• Updated: 30/Aug/21 03:28
• Resolved: 26/Aug/21 10:07

Description

VerifyReplication accepts peerQuorumAddress itself via command parameter instead of getting it from peerid of source cluster.

https://github.com/apache/hbase/commit/b322d0a3e552dc228893408161fd3fb20f6b8bf1#diff-0307194efcf6a3ad4a4d73bd4b6ef34a9be5c436c8e970ca97fa146b2f0aa486

https://issues.apache.org/jira/browse/HBASE-21201

 

    if (peerId != null) {
      assert peerConfigPair != null;
      Configuration peerClusterConf = peerConfigPair.getSecond();
      // Obtain the auth token from peer cluster
      TableMapReduceUtil.initCredentialsForCluster(job, peerClusterConf);
    }

 In this patch, credential for job is obtained when peerid is provided only.
Thus we cannot get the benefit of HBASE-21201 for secure hbase cluster as a destination.

hbase VerifyReplication \
  -D verifyrep.peer.hbase.regionserver.kerberos.principal=secure-hbase-b/[e-mail] \
  -D verifyrep.peer.hbase.master.kerberos.principal=secure-hbase-b/[e-mail] \
  ... \
  secure-hbase-b-1.example.com,secure-hbase-b-2.example.com,secure-hbase-b-3.example.com:2181:/hbase-b \
  table

Assume this execution, VerifyReplication should obtain token from secure-hbase-b-1.example.com,secure-hbase-b-2.example.com,secure-hbase-b-3.example.com:2181:/hbase-b using hbase.regionserver.kerberos.principal=secure-hbase-b/[e-mail] and hbase.master.kerberos.principal=secure-hbase-b/[e-mail], so that VerifyReplication mapper can scan from the secure cluster B.

Issue Links

• links to: GitHub Pull Request #3591
• links to: GitHub Pull Request #3625

Sub-Tasks

• Backport HBASE-26204 to branch-2: VerifyReplication should obtain token for peerQuorumAddress too: Resolved