Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
2.4.17, 2.5.7
Description
Why we need ADMIN permissions for AccessController#preListDecommissionedRegionServers ?
From Phoenix, we are calling Admin#getRegionServers(true) where the argument excludeDecommissionedRS is set to true. Refer here.
If excludeDecommissionedRS is set to true and if we have AccessController co-proc attached, it requires ADMIN permissions to execute listDecommissionedRegionServers RPC. Refer here.
@Override public void preListDecommissionedRegionServers(ObserverContext<MasterCoprocessorEnvironment> ctx) throws IOException { requirePermission(ctx, "listDecommissionedRegionServers", Action.ADMIN); }
I understand that we need ADMIN permissions for preDecommissionRegionServers and preRecommissionRegionServer because it changes the membership of regionservers but I don’t see any need for ADMIN permissions for listDecommissionedRegionServers. Do you think we can remove need for ADMIN permissions for listDecommissionedRegionServers RPC?
Attachments
Issue Links
- links to