Uploaded image for project: 'HBase'
  1. HBase
  2. HBASE-28391

Remove the need for ADMIN permissions for listDecommissionedRegionServers

    XMLWordPrintableJSON

Details

    Description

      Why we need ADMIN permissions for AccessController#preListDecommissionedRegionServers ?

      From Phoenix, we are calling Admin#getRegionServers(true) where the argument excludeDecommissionedRS is set to true. Refer here.
      If excludeDecommissionedRS  is set to true and if we have AccessController co-proc attached, it requires ADMIN permissions to execute listDecommissionedRegionServers RPC. Refer here.
       

        @Override
        public void preListDecommissionedRegionServers(ObserverContext<MasterCoprocessorEnvironment> ctx)
          throws IOException {
          requirePermission(ctx, "listDecommissionedRegionServers", Action.ADMIN);
        }
      

      I understand that we need ADMIN permissions for preDecommissionRegionServers and preRecommissionRegionServer because it changes the membership of regionservers but I don’t see any need for ADMIN permissions for listDecommissionedRegionServers. Do you think we can remove need for ADMIN permissions for  listDecommissionedRegionServers RPC?

      Attachments

        Issue Links

          Activity

            People

              shahrs87 Rushabh Shah
              shahrs87 Rushabh Shah
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: