[HDDS-5138] Upgrade related RPC calls should be allowed only for admins

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Labels: pull-request-available
• Assignee: Ethan Rose
• Reporter: Marton Elek
• Created: 22/Apr/21 08:54
• Updated: 24/May/21 21:16
• Resolved: 24/May/21 21:16

Description

As far as I see any user can finalize upgrade (and I assume the same is true for preparation).

bash-4.2$ kinit -kt /etc/security/keytabs/testuser.keytab testuser/scm
bash-4.2$ ozone sh volume create /vol1
PERMISSION_DENIED User testuser/[e-mail] doesn't have CREATE 
permission to access volume vol1 null null

Failed as I am not an admin, but:

bash-4.2$ ozone admin scm  finalizeupgrade
Upgrade has already been finalized.
Exiting...
bash-4.2$

Please confirm, but I think a quick isAdmin check is missing from all the related RPC endpoints.

Issue Links

• links to: GitHub Pull Request #2217
• links to: pull-request