Skip to content

HBASE-28391 Remove the need for ADMIN permissions for listDecommissionedRegionServers #5695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shahrs87 merged 3 commits into from
Feb 27, 2024
Merged

HBASE-28391 Remove the need for ADMIN permissions for listDecommissionedRegionServers #5695

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f18f2eb
HBASE-28391 Remove the need for ADMIN permissions for listDecommissio…
shahrs87 Feb 21, 2024
2c3efd6
Merge branch 'master' of https://github.com/apache/hbase into HBASE-2…
shahrs87 Feb 26, 2024
b1361ba
HBASE-28391 Change to READ
shahrs87 Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1206,7 +1206,7 @@ public void preDecommissionRegionServers(ObserverContext<MasterCoprocessorEnviro
@Override
Copy link
Contributor

@NihalJain NihalJain Feb 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO we should not drop the method. If we want to allow every user to be able to be able to do so, we should have a no-op method and capture same as comments.

Although I am curious why only this change when we have other methods around listing?

Copy link
Contributor

@NihalJain NihalJain Feb 22, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although I am curious why only this change when we have other methods around listing?

Just saw the JIRA description.

Also, please have a look at @Apache9 comment to change this to Action.READ. And also to start a discussion thread on dev list about this.

Copy link
Contributor Author

@shahrs87 shahrs87 Feb 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to Action.READ. However I am curious to know the difference between removing this method vs having a no-op method?

And also to start a discussion thread on dev list about this.

Created a thread here. https://lists.apache.org/thread/vcf50plmsx59yh4fyvsfpo7xht4rbhz8

Copy link
Contributor

@NihalJain NihalJain Feb 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However I am curious to know the difference between removing this method vs having a no-op method?

IMO removing a method may send a false impression to a future auditor that there is no Access Rule defined for the method or it is somehow missing. And the person may end up re-adding the method. So it's better to have it, even if no-op.

Copy link
Contributor Author

@shahrs87 shahrs87 Feb 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense !!

public void preListDecommissionedRegionServers(ObserverContext<MasterCoprocessorEnvironment> ctx)
throws IOException {
requirePermission(ctx, "listDecommissionedRegionServers", Action.ADMIN);
requirePermission(ctx, "listDecommissionedRegionServers", Action.READ);
}

@Override
Expand Down