HBASE-22580 Add a table attribute to make user scan snapshot feature configurable for table #336
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
💔 -1 overall
This message was automatically generated. |
openinx
reviewed
Jun 25, 2019
| * SnapshotScannerHDFSAclController won't handle HDFS acls for users with table read permission | ||
| * @return true if user scan snapshot is enabled for this table | ||
| */ | ||
| boolean isUserScanSnapshotEnabled(); |
There was a problem hiding this comment.
The TableDescriptor is @InterfaceAudience.Public interfaces, right ? and the snapshot acl is a optional coproccesor ...
I think we can not add an extra specific method in the PUBLIC interface, once someone use this method, then devs can not remove or change this easily, we MUST deprecated it in a old major release, then remove it in another new major release. It is troublesome.
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
fec069d to
5160c62
Compare
openinx
reviewed
Jun 25, 2019
| } | ||
|
|
||
| boolean isTableUserScanSnapshotEnabled(TableDescriptor tableDescriptor) { | ||
| return tableDescriptor.getCoprocessorDescriptors().stream() |
There was a problem hiding this comment.
Just use the TableDescriptor#hasCoprocessor ?
| if (checkTable(currentDescriptor, () -> "modifyTable " + tableName) | ||
| && !hdfsAclHelper.isTableUserScanSnapshotEnabled(oldDescriptor)) { | ||
| hdfsAclHelper.createTableDirectories(tableName); | ||
| Set<String> users = new HashSet<>(); |
There was a problem hiding this comment.
Abstract an small method here ? I saw many places has the logic: to pick up all the users who has the read permission on table / ns / global etc...
| hdfsAclHelper.getUsersWithTableReadAction(tableName); | ||
| users.addAll(userWithTableReadPermission); | ||
| hdfsAclHelper.addTableAcl(tableName, users); | ||
| try (Table aclTable = |
There was a problem hiding this comment.
Also can abstract a method for the flag updating
|
💔 -1 overall
This message was automatically generated. |
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
5160c62 to
f18b3bb
Compare
|
🎊 +1 overall
This message was automatically generated. |
openinx
reviewed
Jun 27, 2019
.../src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java
Outdated
Show resolved
Hide resolved
| @@ -513,12 +518,33 @@ private boolean isHdfsAclSet(Table aclTable, String userName, String namespace, | |||
| return isSet; | |||
| } | |||
|
|
|||
| private boolean checkInitialized() { | |||
| @VisibleForTesting | |||
| boolean checkInitialized(Supplier<String> operation) { | |||
There was a problem hiding this comment.
Just use the string as the argument ? I don't think here we need the Supplier wrapper ...
| && hdfsAclHelper.checkTablePermissionHasNoCfOrCq(tablePermission); | ||
| } | ||
|
|
||
| private boolean needSetTableHdfsAcl(TableName tableName, Supplier<String> operation) |
There was a problem hiding this comment.
Also can remoe the Supplier wrapper ?
| return userPermission.getPermission().implies(Permission.Action.READ); | ||
| } | ||
|
|
||
| boolean checkTablePermissionHasNoCfOrCq(TablePermission tablePermission) { |
There was a problem hiding this comment.
checkTablePermissionHasNoCfOrCq - > isFamilyOrColumnPermission ?
return it as : tablePermission.hasFamily() || tablePermission.hasQualifier() .
|
|
||
| boolean isTableUserScanSnapshotEnabled(TableDescriptor tableDescriptor) { | ||
| String value = tableDescriptor.getValue(USER_SCAN_SNAPSHOT_ENABLE); | ||
| if (value != null && value.equals("true")) { |
There was a problem hiding this comment.
Just :
return Boolean.valueOf(value) ?
| tableUsers, tableName); | ||
| } else if (!aclTableInitialized | ||
| && Bytes.equals(PermissionStorage.ACL_GLOBAL_NAME, tableName.getName())) { | ||
| aclTableInitialized = true; |
There was a problem hiding this comment.
Oh, you update the aclTableInitialized here when add HDFS_ACL_FAMILY in hbase:acl ? Why just update the flag once the modifyTable called successfully ? I think that will be easy to understand.
| } | ||
|
|
||
| boolean isTableUserScanSnapshotEnabled(TableDescriptor tableDescriptor) { | ||
| String value = tableDescriptor.getValue(USER_SCAN_SNAPSHOT_ENABLE); |
There was a problem hiding this comment.
The flag should mean whether will we sync the table access to HDFS files ACL ? I think we should a more clear name ?
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
f18b3bb to
4da7e94
Compare
openinx
reviewed
Jun 28, 2019
| hdfsAclHelper.addTableAcl(tableName, users); | ||
| SnapshotScannerHDFSAclStorage.addUserTableHdfsAcl(ctx.getEnvironment().getConnection(), | ||
| tableUsers, tableName); | ||
| } |
There was a problem hiding this comment.
How it will happen if we have an TableUserScanSnapshot Enabled table, and then modify to disabled ? I think we shold also remove the HDFS ACL ?
|
💔 -1 overall
This message was automatically generated. |
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
4da7e94 to
e6ed33b
Compare
|
🎊 +1 overall
This message was automatically generated. |
openinx
reviewed
Jul 15, 2019
| admin.modifyTable(builder.build()); | ||
| } | ||
| // wait until acl table is online | ||
| List<RegionInfo> tableRegions = MetaTableAccessor.getTableRegions( |
There was a problem hiding this comment.
Why to wait & assign the hbase:acl region ? In theory, the modifyTable will ensure that all of the regions are online.
| @@ -515,6 +560,18 @@ private static AclEntry aclEntry(AclEntryScope scope, String name) { | |||
| .setPermission(READ_EXECUTE).build(); | |||
| } | |||
|
|
|||
| void createNonExistDir(Path path) throws IOException { | |||
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
e6ed33b to
531c054
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
…configurable for table
mymeiyi
force-pushed
the
hdfs-acl-table-attribute
branch
from
531c054 to
5c8a26f
Compare
openinx
approved these changes
Jul 25, 2019
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
mymeiyi
added a commit
that referenced
this pull request
Jul 29, 2019
…configurable for table (#336)
infraio
pushed a commit
to infraio/hbase
that referenced
this pull request
Aug 17, 2020
…configurable for table (apache#336)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.