Uploaded image for project: 'Hadoop HDFS'
  1. Hadoop HDFS
  2. HDFS-11403

Zookeper ACLs on NN HA enabled clusters to be handled consistently

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.9.0, 3.0.0-alpha4
    • Component/s: hdfs
    • Labels:
      None
    • Hadoop Flags:
      Reviewed

      Description

      On clusters where NN HA is enabled zookeper ACLs need to be handled consistently when enabling security.

      The current behavior is as follows:

      • if HA is enabled before the cluster is made secure, proper ACLs are only set on the leaf znodes, while there's no ACLs set on the path (eg.:/hadoop-ha/mycluster/ActiveStandbyElectorLock)
      • if HA is enabled after the cluster is made secure ACLs are set on the root znode as well
      1. HDFS-11403.000.patch
        8 kB
        Hanisha Koneru
      2. HDFS-11403.001.patch
        4 kB
        Hanisha Koneru

        Issue Links

          Activity

          Hide
          arpitagarwal Arpit Agarwal added a comment -

          Thanks for the catch Brahma Reddy Battula.

          Show
          arpitagarwal Arpit Agarwal added a comment - Thanks for the catch Brahma Reddy Battula .
          Hide
          brahmareddy Brahma Reddy Battula added a comment -

          Sorry for landing late here,any purpose why we always use stat.getVersion() why not stat.getAversion()..?

          1083	          zkClient.setACL(path, zkAcl, stat.getVersion());
          

          There can be chance that aclversion(like below case) will be higher than dataversion which might cause Bad Version and fail .

          cversion = 0
          dataVersion = 1
          aclVersion = 5
          ephemeralOwner = 0x0
          dataLength = 4
          

          Please correct me If I am wrong.

          Show
          brahmareddy Brahma Reddy Battula added a comment - Sorry for landing late here,any purpose why we always use stat.getVersion() why not stat.getAversion() ..? 1083 zkClient.setACL(path, zkAcl, stat.getVersion()); There can be chance that aclversion(like below case) will be higher than dataversion which might cause Bad Version and fail . cversion = 0 dataVersion = 1 aclVersion = 5 ephemeralOwner = 0x0 dataLength = 4 Please correct me If I am wrong.
          Hide
          hudson Hudson added a comment -

          SUCCESS: Integrated in Jenkins build Hadoop-trunk-Commit #11234 (See https://builds.apache.org/job/Hadoop-trunk-Commit/11234/)
          HDFS-11403. Zookeper ACLs on NN HA enabled clusters should be handled (arp: rev 0aacd8fd2530f9f5febbe81ec05cd958cc0c3e2c)

          • (edit) hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ha/ActiveStandbyElector.java
          • (edit) hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/ha/TestActiveStandbyElector.java
          Show
          hudson Hudson added a comment - SUCCESS: Integrated in Jenkins build Hadoop-trunk-Commit #11234 (See https://builds.apache.org/job/Hadoop-trunk-Commit/11234/ ) HDFS-11403 . Zookeper ACLs on NN HA enabled clusters should be handled (arp: rev 0aacd8fd2530f9f5febbe81ec05cd958cc0c3e2c) (edit) hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/ha/ActiveStandbyElector.java (edit) hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/ha/TestActiveStandbyElector.java
          Hide
          arpitagarwal Arpit Agarwal added a comment -

          Committed this. Thanks for the contribution Hanisha Koneru.

          Show
          arpitagarwal Arpit Agarwal added a comment - Committed this. Thanks for the contribution Hanisha Koneru .
          Hide
          hadoopqa Hadoop QA added a comment -
          +1 overall



          Vote Subsystem Runtime Comment
          0 reexec 0m 21s Docker mode activated.
          +1 @author 0m 0s The patch does not contain any @author tags.
          +1 test4tests 0m 0s The patch appears to include 1 new or modified test files.
          +1 mvninstall 13m 31s trunk passed
          +1 compile 14m 16s trunk passed
          +1 checkstyle 0m 31s trunk passed
          +1 mvnsite 1m 7s trunk passed
          +1 mvneclipse 0m 20s trunk passed
          +1 findbugs 1m 37s trunk passed
          +1 javadoc 0m 51s trunk passed
          +1 mvninstall 0m 42s the patch passed
          +1 compile 11m 51s the patch passed
          +1 javac 11m 51s the patch passed
          -0 checkstyle 0m 30s hadoop-common-project/hadoop-common: The patch generated 1 new + 40 unchanged - 0 fixed = 41 total (was 40)
          +1 mvnsite 1m 5s the patch passed
          +1 mvneclipse 0m 19s the patch passed
          +1 whitespace 0m 0s The patch has no whitespace issues.
          +1 findbugs 1m 46s the patch passed
          +1 javadoc 0m 50s the patch passed
          +1 unit 8m 39s hadoop-common in the patch passed.
          +1 asflicense 0m 34s The patch does not generate ASF License warnings.
          59m 54s



          Subsystem Report/Notes
          Docker Image:yetus/hadoop:a9ad5d6
          JIRA Issue HDFS-11403
          JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12852164/HDFS-11403.001.patch
          Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle
          uname Linux c090a7787bdd 3.13.0-105-generic #152-Ubuntu SMP Fri Dec 2 15:37:11 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
          Build tool maven
          Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh
          git revision trunk / 07a5184
          Default Java 1.8.0_121
          findbugs v3.0.0
          checkstyle https://builds.apache.org/job/PreCommit-HDFS-Build/18350/artifact/patchprocess/diff-checkstyle-hadoop-common-project_hadoop-common.txt
          Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/18350/testReport/
          modules C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common
          Console output https://builds.apache.org/job/PreCommit-HDFS-Build/18350/console
          Powered by Apache Yetus 0.5.0-SNAPSHOT http://yetus.apache.org

          This message was automatically generated.

          Show
          hadoopqa Hadoop QA added a comment - +1 overall Vote Subsystem Runtime Comment 0 reexec 0m 21s Docker mode activated. +1 @author 0m 0s The patch does not contain any @author tags. +1 test4tests 0m 0s The patch appears to include 1 new or modified test files. +1 mvninstall 13m 31s trunk passed +1 compile 14m 16s trunk passed +1 checkstyle 0m 31s trunk passed +1 mvnsite 1m 7s trunk passed +1 mvneclipse 0m 20s trunk passed +1 findbugs 1m 37s trunk passed +1 javadoc 0m 51s trunk passed +1 mvninstall 0m 42s the patch passed +1 compile 11m 51s the patch passed +1 javac 11m 51s the patch passed -0 checkstyle 0m 30s hadoop-common-project/hadoop-common: The patch generated 1 new + 40 unchanged - 0 fixed = 41 total (was 40) +1 mvnsite 1m 5s the patch passed +1 mvneclipse 0m 19s the patch passed +1 whitespace 0m 0s The patch has no whitespace issues. +1 findbugs 1m 46s the patch passed +1 javadoc 0m 50s the patch passed +1 unit 8m 39s hadoop-common in the patch passed. +1 asflicense 0m 34s The patch does not generate ASF License warnings. 59m 54s Subsystem Report/Notes Docker Image:yetus/hadoop:a9ad5d6 JIRA Issue HDFS-11403 JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12852164/HDFS-11403.001.patch Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle uname Linux c090a7787bdd 3.13.0-105-generic #152-Ubuntu SMP Fri Dec 2 15:37:11 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Build tool maven Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh git revision trunk / 07a5184 Default Java 1.8.0_121 findbugs v3.0.0 checkstyle https://builds.apache.org/job/PreCommit-HDFS-Build/18350/artifact/patchprocess/diff-checkstyle-hadoop-common-project_hadoop-common.txt Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/18350/testReport/ modules C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common Console output https://builds.apache.org/job/PreCommit-HDFS-Build/18350/console Powered by Apache Yetus 0.5.0-SNAPSHOT http://yetus.apache.org This message was automatically generated.
          Hide
          arpitagarwal Arpit Agarwal added a comment -

          +1 pending Jenkins.

          The following check is unnecessary since prefix will never be "/". It's harmless and in pre-existing tests. We can do a separate patch to remove it everywhere.

                if (!"/".equals(prefix.toString())) {
          
          Show
          arpitagarwal Arpit Agarwal added a comment - +1 pending Jenkins. The following check is unnecessary since prefix will never be "/". It's harmless and in pre-existing tests. We can do a separate patch to remove it everywhere. if (! "/" .equals(prefix.toString())) {
          Hide
          hanishakoneru Hanisha Koneru added a comment -

          Thank you Arpit Agarwal for guiding me on this.

          Patch v01 has the following changes

          • setAcl on Parent zNodes is attempted with retries, similar to other zk actions.
          • moved and changed unit test.
          Show
          hanishakoneru Hanisha Koneru added a comment - Thank you Arpit Agarwal for guiding me on this. Patch v01 has the following changes setAcl on Parent zNodes is attempted with retries, similar to other zk actions. moved and changed unit test.
          Hide
          hadoopqa Hadoop QA added a comment -
          -1 overall



          Vote Subsystem Runtime Comment
          0 reexec 0m 18s Docker mode activated.
          +1 @author 0m 0s The patch does not contain any @author tags.
          +1 test4tests 0m 0s The patch appears to include 2 new or modified test files.
          +1 mvninstall 13m 35s trunk passed
          +1 compile 20m 12s trunk passed
          +1 checkstyle 0m 32s trunk passed
          +1 mvnsite 1m 10s trunk passed
          +1 mvneclipse 0m 19s trunk passed
          +1 findbugs 1m 41s trunk passed
          +1 javadoc 0m 48s trunk passed
          +1 mvninstall 0m 37s the patch passed
          +1 compile 11m 24s the patch passed
          +1 javac 11m 24s the patch passed
          -0 checkstyle 0m 29s hadoop-common-project/hadoop-common: The patch generated 46 new + 60 unchanged - 0 fixed = 106 total (was 60)
          +1 mvnsite 0m 59s the patch passed
          +1 mvneclipse 0m 19s the patch passed
          -1 whitespace 0m 0s The patch 51 line(s) with tabs.
          +1 findbugs 1m 33s the patch passed
          +1 javadoc 0m 48s the patch passed
          +1 unit 7m 47s hadoop-common in the patch passed.
          +1 asflicense 0m 34s The patch does not generate ASF License warnings.
          64m 8s



          Subsystem Report/Notes
          Docker Image:yetus/hadoop:a9ad5d6
          JIRA Issue HDFS-11403
          JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12852028/HDFS-11403.000.patch
          Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle
          uname Linux 79d0d52ba7d8 3.13.0-107-generic #154-Ubuntu SMP Tue Dec 20 09:57:27 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
          Build tool maven
          Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh
          git revision trunk / 5b15129
          Default Java 1.8.0_121
          findbugs v3.0.0
          checkstyle https://builds.apache.org/job/PreCommit-HDFS-Build/18346/artifact/patchprocess/diff-checkstyle-hadoop-common-project_hadoop-common.txt
          whitespace https://builds.apache.org/job/PreCommit-HDFS-Build/18346/artifact/patchprocess/whitespace-tabs.txt
          Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/18346/testReport/
          modules C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common
          Console output https://builds.apache.org/job/PreCommit-HDFS-Build/18346/console
          Powered by Apache Yetus 0.5.0-SNAPSHOT http://yetus.apache.org

          This message was automatically generated.

          Show
          hadoopqa Hadoop QA added a comment - -1 overall Vote Subsystem Runtime Comment 0 reexec 0m 18s Docker mode activated. +1 @author 0m 0s The patch does not contain any @author tags. +1 test4tests 0m 0s The patch appears to include 2 new or modified test files. +1 mvninstall 13m 35s trunk passed +1 compile 20m 12s trunk passed +1 checkstyle 0m 32s trunk passed +1 mvnsite 1m 10s trunk passed +1 mvneclipse 0m 19s trunk passed +1 findbugs 1m 41s trunk passed +1 javadoc 0m 48s trunk passed +1 mvninstall 0m 37s the patch passed +1 compile 11m 24s the patch passed +1 javac 11m 24s the patch passed -0 checkstyle 0m 29s hadoop-common-project/hadoop-common: The patch generated 46 new + 60 unchanged - 0 fixed = 106 total (was 60) +1 mvnsite 0m 59s the patch passed +1 mvneclipse 0m 19s the patch passed -1 whitespace 0m 0s The patch 51 line(s) with tabs. +1 findbugs 1m 33s the patch passed +1 javadoc 0m 48s the patch passed +1 unit 7m 47s hadoop-common in the patch passed. +1 asflicense 0m 34s The patch does not generate ASF License warnings. 64m 8s Subsystem Report/Notes Docker Image:yetus/hadoop:a9ad5d6 JIRA Issue HDFS-11403 JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12852028/HDFS-11403.000.patch Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle uname Linux 79d0d52ba7d8 3.13.0-107-generic #154-Ubuntu SMP Tue Dec 20 09:57:27 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Build tool maven Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh git revision trunk / 5b15129 Default Java 1.8.0_121 findbugs v3.0.0 checkstyle https://builds.apache.org/job/PreCommit-HDFS-Build/18346/artifact/patchprocess/diff-checkstyle-hadoop-common-project_hadoop-common.txt whitespace https://builds.apache.org/job/PreCommit-HDFS-Build/18346/artifact/patchprocess/whitespace-tabs.txt Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/18346/testReport/ modules C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common Console output https://builds.apache.org/job/PreCommit-HDFS-Build/18346/console Powered by Apache Yetus 0.5.0-SNAPSHOT http://yetus.apache.org This message was automatically generated.
          Hide
          hanishakoneru Hanisha Koneru added a comment -

          Thank you Laszlo Puskas for reporting this issue.

          Show
          hanishakoneru Hanisha Koneru added a comment - Thank you Laszlo Puskas for reporting this issue.

            People

            • Assignee:
              hanishakoneru Hanisha Koneru
              Reporter:
              lpuskas Laszlo Puskas
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development