Skip to content

Commit b5d7560

Browse files
mymeiyimymeiyi
committed
HBASE-22776 Rename config names in user scan snapshot feature
1 parent 7e6684b commit b5d7560

File tree

5 files changed

+563
-275
lines changed

5 files changed

+563
-275
lines changed

‎hbase-server/src/main/java/org/apache/hadoop/hbase/master/snapshot/SnapshotManager.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@
7171
import org.apache.hadoop.hbase.security.AccessDeniedException;
7272
import org.apache.hadoop.hbase.security.User;
7373
import org.apache.hadoop.hbase.security.access.AccessChecker;
74+
import org.apache.hadoop.hbase.security.access.SnapshotScannerHDFSAclCleaner;
75+
import org.apache.hadoop.hbase.security.access.SnapshotScannerHDFSAclHelper;
7476
import org.apache.hadoop.hbase.snapshot.ClientSnapshotDescriptionUtils;
7577
import org.apache.hadoop.hbase.snapshot.HBaseSnapshotException;
7678
import org.apache.hadoop.hbase.snapshot.RestoreSnapshotException;
@@ -1123,6 +1125,10 @@ private void checkSnapshotSupport(final Configuration conf, final MasterFileSyst
11231125
// Inject snapshot cleaners, if snapshot.enable is true
11241126
hfileCleaners.add(SnapshotHFileCleaner.class.getName());
11251127
hfileCleaners.add(HFileLinkCleaner.class.getName());
1128+
// If sync acl to HDFS feature is enabled, then inject the cleaner
1129+
if (SnapshotScannerHDFSAclHelper.isAclSyncToHdfsEnabled(conf)) {
1130+
hfileCleaners.add(SnapshotScannerHDFSAclCleaner.class.getName());
1131+
}
11261132

11271133
// Set cleaners conf
11281134
conf.setStrings(HFileCleaner.MASTER_HFILE_CLEANER_PLUGINS,

‎hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclCleaner.java‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
import org.apache.hadoop.hbase.HConstants;
2828
import org.apache.hadoop.hbase.MetaTableAccessor;
2929
import org.apache.hadoop.hbase.TableName;
30-
import org.apache.hadoop.hbase.coprocessor.CoprocessorHost;
3130
import org.apache.hadoop.hbase.master.HMaster;
3231
import org.apache.hadoop.hbase.master.cleaner.BaseHFileCleanerDelegate;
3332
import org.apache.yetus.audience.InterfaceAudience;
@@ -59,7 +58,7 @@ public void init(Map<String, Object> params) {
5958
@Override
6059
public void setConf(Configuration conf) {
6160
super.setConf(conf);
62-
userScanSnapshotEnabled = isUserScanSnapshotEnabled(conf);
61+
userScanSnapshotEnabled = SnapshotScannerHDFSAclHelper.isAclSyncToHdfsEnabled(conf);
6362
}
6463

6564
@Override
@@ -82,13 +81,6 @@ public boolean isEmptyDirDeletable(Path dir) {
8281
return true;
8382
}
8483

85-
private boolean isUserScanSnapshotEnabled(Configuration conf) {
86-
String masterCoprocessors = conf.get(CoprocessorHost.MASTER_COPROCESSOR_CONF_KEY);
87-
return conf.getBoolean(SnapshotScannerHDFSAclHelper.USER_SCAN_SNAPSHOT_ENABLE, false)
88-
&& masterCoprocessors.contains(SnapshotScannerHDFSAclController.class.getName())
89-
&& masterCoprocessors.contains(AccessController.class.getName());
90-
}
91-
9284
private boolean isEmptyArchiveDirDeletable(Path dir) {
9385
try {
9486
if (isArchiveDataDir(dir)) {

‎hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java‎

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ public Optional<MasterObserver> getMasterObserver() {
119119
public void preMasterInitialization(ObserverContext<MasterCoprocessorEnvironment> c)
120120
throws IOException {
121121
if (c.getEnvironment().getConfiguration()
122-
.getBoolean(SnapshotScannerHDFSAclHelper.USER_SCAN_SNAPSHOT_ENABLE, false)) {
122+
.getBoolean(SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE, false)) {
123123
MasterCoprocessorEnvironment mEnv = c.getEnvironment();
124124
if (!(mEnv instanceof HasMasterServices)) {
125125
throw new IOException("Does not implement HMasterServices");
@@ -133,7 +133,7 @@ public void preMasterInitialization(ObserverContext<MasterCoprocessorEnvironment
133133
userProvider = UserProvider.instantiate(c.getEnvironment().getConfiguration());
134134
} else {
135135
LOG.warn("Try to initialize the coprocessor SnapshotScannerHDFSAclController but failure "
136-
+ "because the config " + SnapshotScannerHDFSAclHelper.USER_SCAN_SNAPSHOT_ENABLE
136+
+ "because the config " + SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE
137137
+ " is false.");
138138
}
139139
}
@@ -213,6 +213,7 @@ public void postCompletedSnapshotAction(ObserverContext<MasterCoprocessorEnviron
213213
public void postCompletedTruncateTableAction(ObserverContext<MasterCoprocessorEnvironment> c,
214214
TableName tableName) throws IOException {
215215
if (needHandleTableHdfsAcl(tableName, "truncateTable " + tableName)) {
216+
hdfsAclHelper.createTableDirectories(tableName);
216217
// Since the table directories is recreated, so add HDFS acls again
217218
Set<String> users = hdfsAclHelper.getUsersWithTableReadAction(tableName, false, false);
218219
hdfsAclHelper.addTableAcl(tableName, users, "truncate");
@@ -233,9 +234,11 @@ public void postDeleteTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
233234
try (Table aclTable =
234235
ctx.getEnvironment().getConnection().getTable(PermissionStorage.ACL_TABLE_NAME)) {
235236
Set<String> users = SnapshotScannerHDFSAclStorage.getTableUsers(aclTable, tableName);
236-
// 1. Delete table owner permission is synced to HDFS in acl table
237+
// 1. Remove table archive directory default ACLs
238+
hdfsAclHelper.removeTableDefaultAcl(tableName, users);
239+
// 2. Delete table owner permission is synced to HDFS in acl table
237240
SnapshotScannerHDFSAclStorage.deleteTableHdfsAcl(aclTable, tableName);
238-
// 2. Remove namespace access acls
241+
// 3. Remove namespace access acls
239242
Set<String> removeUsers = filterUsersToRemoveNsAccessAcl(aclTable, tableName, users);
240243
if (removeUsers.size() > 0) {
241244
hdfsAclHelper.removeNamespaceAccessAcl(tableName, removeUsers, "delete");
@@ -251,7 +254,7 @@ public void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
251254
try (Table aclTable =
252255
ctx.getEnvironment().getConnection().getTable(PermissionStorage.ACL_TABLE_NAME)) {
253256
if (needHandleTableHdfsAcl(currentDescriptor, "modifyTable " + tableName)
254-
&& !hdfsAclHelper.isTableUserScanSnapshotEnabled(oldDescriptor)) {
257+
&& !hdfsAclHelper.isAclSyncToHdfsEnabled(oldDescriptor)) {
255258
// 1. Create table directories used for acl inherited
256259
hdfsAclHelper.createTableDirectories(tableName);
257260
// 2. Add table users HDFS acls
@@ -264,7 +267,7 @@ public void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
264267
SnapshotScannerHDFSAclStorage.addUserTableHdfsAcl(ctx.getEnvironment().getConnection(),
265268
tableUsers, tableName);
266269
} else if (needHandleTableHdfsAcl(oldDescriptor, "modifyTable " + tableName)
267-
&& !hdfsAclHelper.isTableUserScanSnapshotEnabled(currentDescriptor)) {
270+
&& !hdfsAclHelper.isAclSyncToHdfsEnabled(currentDescriptor)) {
268271
// 1. Remove empty table directories
269272
List<Path> tableRootPaths = hdfsAclHelper.getTableRootPaths(tableName, false);
270273
for (Path path : tableRootPaths) {
@@ -290,17 +293,24 @@ public void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
290293
public void postDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
291294
String namespace) throws IOException {
292295
if (checkInitialized("deleteNamespace " + namespace)) {
293-
// 1. Record namespace user acl is not synced to HDFS
294-
SnapshotScannerHDFSAclStorage.deleteNamespaceHdfsAcl(ctx.getEnvironment().getConnection(),
295-
namespace);
296-
// 2. Delete tmp namespace directory
297-
/**
298-
* Delete namespace tmp directory because it's created by this coprocessor when namespace is
299-
* created to make namespace default acl can be inherited by tables. The namespace data
300-
* directory is deleted by DeleteNamespaceProcedure, the namespace archive directory is
301-
* deleted by HFileCleaner.
302-
*/
303-
hdfsAclHelper.deleteEmptyDir(pathHelper.getTmpNsDir(namespace));
296+
try (Table aclTable =
297+
ctx.getEnvironment().getConnection().getTable(PermissionStorage.ACL_TABLE_NAME)) {
298+
// 1. Delete namespace archive dir default ACLs
299+
Set<String> users = SnapshotScannerHDFSAclStorage.getEntryUsers(aclTable,
300+
PermissionStorage.toNamespaceEntry(Bytes.toBytes(namespace)));
301+
hdfsAclHelper.removeNamespaceDefaultAcl(namespace, users);
302+
// 2. Record namespace user acl is not synced to HDFS
303+
SnapshotScannerHDFSAclStorage.deleteNamespaceHdfsAcl(ctx.getEnvironment().getConnection(),
304+
namespace);
305+
// 3. Delete tmp namespace directory
306+
/**
307+
* Delete namespace tmp directory because it's created by this coprocessor when namespace is
308+
* created to make namespace default acl can be inherited by tables. The namespace data
309+
* directory is deleted by DeleteNamespaceProcedure, the namespace archive directory is
310+
* deleted by HFileCleaner.
311+
*/
312+
hdfsAclHelper.deleteEmptyDir(pathHelper.getTmpNsDir(namespace));
313+
}
304314
}
305315
}
306316

@@ -364,7 +374,9 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
364374
UserPermission tPerm = getUserTablePermission(conf, userName, tableName);
365375
if (tPerm != null && hdfsAclHelper.containReadAction(tPerm)) {
366376
if (!isHdfsAclSet(aclTable, userName, tableName)) {
367-
// 1. Add HDFS acl
377+
// 1. create table dirs
378+
hdfsAclHelper.createTableDirectories(tableName);
379+
// 2. Add HDFS acl
368380
hdfsAclHelper.grantAcl(userPermission, new HashSet<>(0), new HashSet<>(0));
369381
}
370382
// 2. Record table acl is synced to HDFS
@@ -547,13 +559,13 @@ private boolean needHandleTableHdfsAcl(TablePermission tablePermission) throws I
547559

548560
private boolean needHandleTableHdfsAcl(TableName tableName, String operation) throws IOException {
549561
return !tableName.isSystemTable() && checkInitialized(operation) && hdfsAclHelper
550-
.isTableUserScanSnapshotEnabled(masterServices.getTableDescriptors().get(tableName));
562+
.isAclSyncToHdfsEnabled(masterServices.getTableDescriptors().get(tableName));
551563
}
552564

553565
private boolean needHandleTableHdfsAcl(TableDescriptor tableDescriptor, String operation) {
554566
TableName tableName = tableDescriptor.getTableName();
555567
return !tableName.isSystemTable() && checkInitialized(operation)
556-
&& hdfsAclHelper.isTableUserScanSnapshotEnabled(tableDescriptor);
568+
&& hdfsAclHelper.isAclSyncToHdfsEnabled(tableDescriptor);
557569
}
558570

559571
private User getActiveUser(ObserverContext<?> ctx) throws IOException {

‎hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclHelper.java‎

Lines changed: 62 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import org.apache.hadoop.hbase.client.Connection;
5454
import org.apache.hadoop.hbase.client.SnapshotDescription;
5555
import org.apache.hadoop.hbase.client.TableDescriptor;
56+
import org.apache.hadoop.hbase.coprocessor.CoprocessorHost;
5657
import org.apache.hadoop.hbase.mob.MobUtils;
5758
import org.apache.hadoop.hbase.util.Bytes;
5859
import org.apache.yetus.audience.InterfaceAudience;
@@ -71,23 +72,23 @@
7172
public class SnapshotScannerHDFSAclHelper implements Closeable {
7273
private static final Logger LOG = LoggerFactory.getLogger(SnapshotScannerHDFSAclHelper.class);
7374

74-
public static final String USER_SCAN_SNAPSHOT_ENABLE = "hbase.user.scan.snapshot.enable";
75-
public static final String USER_SCAN_SNAPSHOT_THREAD_NUMBER =
76-
"hbase.user.scan.snapshot.thread.number";
75+
public static final String ACL_SYNC_TO_HDFS_ENABLE = "hbase.acl.sync.to.hdfs.enable";
76+
public static final String ACL_SYNC_TO_HDFS_THREAD_NUMBER =
77+
"hbase.acl.sync.to.hdfs.thread.number";
7778
// The tmp directory to restore snapshot, it can not be a sub directory of HBase root dir
7879
public static final String SNAPSHOT_RESTORE_TMP_DIR = "hbase.snapshot.restore.tmp.dir";
7980
public static final String SNAPSHOT_RESTORE_TMP_DIR_DEFAULT =
8081
"/hbase/.tmpdir-to-restore-snapshot";
8182
// The default permission of the common directories if the feature is enabled.
8283
public static final String COMMON_DIRECTORY_PERMISSION =
83-
"hbase.user.scan.snapshot.common.directory.permission";
84+
"hbase.acl.sync.to.hdfs.common.directory.permission";
8485
// The secure HBase permission is 700, 751 means all others have execute access and the mask is
8586
// set to read-execute to make the extended access ACL entries can work. Be cautious to set
8687
// this value.
8788
public static final String COMMON_DIRECTORY_PERMISSION_DEFAULT = "751";
8889
// The default permission of the snapshot restore directories if the feature is enabled.
8990
public static final String SNAPSHOT_RESTORE_DIRECTORY_PERMISSION =
90-
"hbase.user.scan.snapshot.restore.directory.permission";
91+
"hbase.acl.sync.to.hdfs.restore.directory.permission";
9192
// 753 means all others have write-execute access.
9293
public static final String SNAPSHOT_RESTORE_DIRECTORY_PERMISSION_DEFAULT = "753";
9394

@@ -102,7 +103,7 @@ public SnapshotScannerHDFSAclHelper(Configuration configuration, Connection conn
102103
this.conf = configuration;
103104
this.pathHelper = new PathHelper(conf);
104105
this.fs = pathHelper.getFileSystem();
105-
this.pool = Executors.newFixedThreadPool(conf.getInt(USER_SCAN_SNAPSHOT_THREAD_NUMBER, 10),
106+
this.pool = Executors.newFixedThreadPool(conf.getInt(ACL_SYNC_TO_HDFS_THREAD_NUMBER, 10),
106107
new ThreadFactoryBuilder().setNameFormat("hdfs-acl-thread-%d").setDaemon(true).build());
107108
this.admin = connection.getAdmin();
108109
}
@@ -230,6 +231,50 @@ public boolean removeNamespaceAccessAcl(TableName tableName, Set<String> removeU
230231
}
231232
}
232233

234+
/**
235+
* Remove default acl from namespace archive dir when delete namespace
236+
* @param namespace the namespace
237+
* @param removeUsers the users whose default acl will be removed
238+
* @return false if an error occurred, otherwise true
239+
*/
240+
public boolean removeNamespaceDefaultAcl(String namespace, Set<String> removeUsers) {
241+
try {
242+
long start = System.currentTimeMillis();
243+
Path archiveNsDir = pathHelper.getArchiveNsDir(namespace);
244+
HDFSAclOperation operation = new HDFSAclOperation(fs, archiveNsDir, removeUsers,
245+
HDFSAclOperation.OperationType.REMOVE, false, HDFSAclOperation.AclType.DEFAULT);
246+
operation.handleAcl();
247+
LOG.info("Remove HDFS acl when delete namespace {}, cost {} ms", namespace,
248+
System.currentTimeMillis() - start);
249+
return true;
250+
} catch (Exception e) {
251+
LOG.error("Remove HDFS acl error when delete namespace {}", namespace, e);
252+
return false;
253+
}
254+
}
255+
256+
/**
257+
* Remove default acl from table archive dir when delete table
258+
* @param tableName the table name
259+
* @param removeUsers the users whose default acl will be removed
260+
* @return false if an error occurred, otherwise true
261+
*/
262+
public boolean removeTableDefaultAcl(TableName tableName, Set<String> removeUsers) {
263+
try {
264+
long start = System.currentTimeMillis();
265+
Path archiveTableDir = pathHelper.getArchiveTableDir(tableName);
266+
HDFSAclOperation operation = new HDFSAclOperation(fs, archiveTableDir, removeUsers,
267+
HDFSAclOperation.OperationType.REMOVE, false, HDFSAclOperation.AclType.DEFAULT);
268+
operation.handleAcl();
269+
LOG.info("Remove HDFS acl when delete table {}, cost {} ms", tableName,
270+
System.currentTimeMillis() - start);
271+
return true;
272+
} catch (Exception e) {
273+
LOG.error("Remove HDFS acl error when delete table {}", tableName, e);
274+
return false;
275+
}
276+
}
277+
233278
/**
234279
* Add table user acls
235280
* @param tableName the table
@@ -349,7 +394,7 @@ private void handleNamespaceAcl(Set<String> namespaces, Set<String> users,
349394
Set<TableName> tables = new HashSet<>();
350395
for (String namespace : namespaces) {
351396
tables.addAll(admin.listTableDescriptorsByNamespace(Bytes.toBytes(namespace)).stream()
352-
.filter(this::isTableUserScanSnapshotEnabled).map(TableDescriptor::getTableName)
397+
.filter(this::isAclSyncToHdfsEnabled).map(TableDescriptor::getTableName)
353398
.collect(Collectors.toSet()));
354399
}
355400
handleTableAcl(tables, users, skipNamespaces, skipTables, operationType);
@@ -403,7 +448,7 @@ void createTableDirectories(TableName tableName) throws IOException {
403448
* return paths that user will global permission will visit
404449
* @return the path list
405450
*/
406-
private List<Path> getGlobalRootPaths() {
451+
List<Path> getGlobalRootPaths() {
407452
return Lists.newArrayList(pathHelper.getTmpDataDir(), pathHelper.getDataDir(),
408453
pathHelper.getMobDataDir(), pathHelper.getArchiveDataDir(), pathHelper.getSnapshotRootDir());
409454
}
@@ -511,9 +556,16 @@ boolean isNotFamilyOrQualifierPermission(TablePermission tablePermission) {
511556
return !tablePermission.hasFamily() && !tablePermission.hasQualifier();
512557
}
513558

514-
boolean isTableUserScanSnapshotEnabled(TableDescriptor tableDescriptor) {
559+
public static boolean isAclSyncToHdfsEnabled(Configuration conf) {
560+
String masterCoprocessors = conf.get(CoprocessorHost.MASTER_COPROCESSOR_CONF_KEY);
561+
return conf.getBoolean(SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE, false)
562+
&& masterCoprocessors.contains(SnapshotScannerHDFSAclController.class.getName())
563+
&& masterCoprocessors.contains(AccessController.class.getName());
564+
}
565+
566+
boolean isAclSyncToHdfsEnabled(TableDescriptor tableDescriptor) {
515567
return tableDescriptor == null ? false
516-
: Boolean.valueOf(tableDescriptor.getValue(USER_SCAN_SNAPSHOT_ENABLE));
568+
: Boolean.valueOf(tableDescriptor.getValue(ACL_SYNC_TO_HDFS_ENABLE));
517569
}
518570

519571
PathHelper getPathHelper() {

0 commit comments

Comments
 (0)