You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hbase.apache.org by "张铎(Duo Zhang)" <pa...@gmail.com> on 2023/10/12 02:47:27 UTC

Re: [DISCUSS] Upgrade Zookeeper and Curator to latest version

Bump.

There is a new CVE in zookeeper before 3.7.2.

https://nvd.nist.gov/vuln/detail/CVE-2023-44981

I think maybe it is time for us to bump the zookeeper version now.

Thanks.

张铎(Duo Zhang) <pa...@gmail.com> 于2023年3月16日周四 18:27写道：
>
> We only use Curator in hbase-examples IIRC, so it should be OK to upgrade it.
>
> For ZooKeeper, besides client server wire compatibility, we also need to consider java compatibility. For example, different protobuf versions can communicate with each other, but if you depend on protobuf 2.5 and 3.x in the java project, you will be in trouble as the classes are different...
>
> So the question here is, if we upgrade ZooKeeper to 3.8.x, will it break downstream users who are still on ZooKeeper 3.6.x or 3.7.x?
>
> Thanks.
>
> Villő Szűcs <sz...@cloudera.com.invalid> 于2023年2月28日周二 22:33写道：
>>
>> Hi,
>> I’d like to upgrade zookeeper in hbase (and in other components as well) to
>> 3.8.1 version and curator to 5.4.0 version.
>> It is useful since the current zookeeper version 3.5.7 is EOL and we should
>> release HBASE 3 with the latest zookeeper to be on an active version.
>> ZooKeeper clients from 3.5.x onwards are fully compatible with 3.8.x
>> servers. ZooKeeper 3.8.x clients are compatible with 3.5.x, 3.6.x and 3.7.x
>> servers as long as we are not using new APIs not present these versions.
>> See ZooKeeper 3.8.0 Release Notes[1] for details.
>> Curator 5.0 contains a few non-backward compatible/breaking changes from
>> previous versions: https://curator.apache.org/breaking-changes.html, but
>> these changes have no effect on hbase. See Curator Release Notes[2] for
>> details.
>> Do you have any suggestions?
>>
>> [1] https://zookeeper.apache.org/doc/r3.8.0/releasenotes.html
>> [2] https://cwiki.apache.org/confluence/display/CURATOR/Releases

Re: [DISCUSS] Upgrade Zookeeper and Curator to latest version

Posted by "张铎(Duo Zhang)" <pa...@gmail.com>.
The PR is ready.

https://github.com/apache/hbase/pull/5475

PTAL if you have interest.

It is not as easy as changing a version string in pom.xml, because
zookeeper also cleaned up its dependencies a lot for not introducing
unnecessary dependencies to downstream users when they only want to
use zookeeper client, but we also need zookeeper server.

Nick Dimiduk <nd...@apache.org> 于2023年10月19日周四 23:52写道：
>
> This plan sounds good to me.
>
> From the earlier message, we should be okay to upgrade branch-2.5 as well,
> though I wonder if we can ErrorProne the new API methods.
>
> Thanks,
> Nick
>
> On Thu, 19 Oct 2023 at 02:55, 张铎(Duo Zhang) <pa...@gmail.com> wrote:
>
> > Filed https://issues.apache.org/jira/browse/HBASE-28153.
> >
> > If there are no objections, I will provide a PR there to upgrade the
> > zookeeper version to 3.8.x on branch-2+.
> >
> > For branch-2.4, I prefer we just leave it as is because soon it will be
> > EOL.
> >
> > For branch-2.5, I think it depends on the RM's opinion.
> >
> > Thanks.
> >
> > 张铎(Duo Zhang) <pa...@gmail.com> 于2023年10月12日周四 10:47写道：
> > >
> > > Bump.
> > >
> > > There is a new CVE in zookeeper before 3.7.2.
> > >
> > > https://nvd.nist.gov/vuln/detail/CVE-2023-44981
> > >
> > > I think maybe it is time for us to bump the zookeeper version now.
> > >
> > > Thanks.
> > >
> > > 张铎(Duo Zhang) <pa...@gmail.com> 于2023年3月16日周四 18:27写道：
> > > >
> > > > We only use Curator in hbase-examples IIRC, so it should be OK to
> > upgrade it.
> > > >
> > > > For ZooKeeper, besides client server wire compatibility, we also need
> > to consider java compatibility. For example, different protobuf versions
> > can communicate with each other, but if you depend on protobuf 2.5 and 3.x
> > in the java project, you will be in trouble as the classes are different...
> > > >
> > > > So the question here is, if we upgrade ZooKeeper to 3.8.x, will it
> > break downstream users who are still on ZooKeeper 3.6.x or 3.7.x?
> > > >
> > > > Thanks.
> > > >
> > > > Villő Szűcs <sz...@cloudera.com.invalid> 于2023年2月28日周二 22:33写道：
> > > >>
> > > >> Hi,
> > > >> I’d like to upgrade zookeeper in hbase (and in other components as
> > well) to
> > > >> 3.8.1 version and curator to 5.4.0 version.
> > > >> It is useful since the current zookeeper version 3.5.7 is EOL and we
> > should
> > > >> release HBASE 3 with the latest zookeeper to be on an active version.
> > > >> ZooKeeper clients from 3.5.x onwards are fully compatible with 3.8.x
> > > >> servers. ZooKeeper 3.8.x clients are compatible with 3.5.x, 3.6.x and
> > 3.7.x
> > > >> servers as long as we are not using new APIs not present these
> > versions.
> > > >> See ZooKeeper 3.8.0 Release Notes[1] for details.
> > > >> Curator 5.0 contains a few non-backward compatible/breaking changes
> > from
> > > >> previous versions: https://curator.apache.org/breaking-changes.html,
> > but
> > > >> these changes have no effect on hbase. See Curator Release Notes[2]
> > for
> > > >> details.
> > > >> Do you have any suggestions?
> > > >>
> > > >> [1] https://zookeeper.apache.org/doc/r3.8.0/releasenotes.html
> > > >> [2] https://cwiki.apache.org/confluence/display/CURATOR/Releases
> >

Re: [DISCUSS] Upgrade Zookeeper and Curator to latest version

Posted by Nick Dimiduk <nd...@apache.org>.
This plan sounds good to me.

From the earlier message, we should be okay to upgrade branch-2.5 as well,
though I wonder if we can ErrorProne the new API methods.

Thanks,
Nick

On Thu, 19 Oct 2023 at 02:55, 张铎(Duo Zhang) <pa...@gmail.com> wrote:

> Filed https://issues.apache.org/jira/browse/HBASE-28153.
>
> If there are no objections, I will provide a PR there to upgrade the
> zookeeper version to 3.8.x on branch-2+.
>
> For branch-2.4, I prefer we just leave it as is because soon it will be
> EOL.
>
> For branch-2.5, I think it depends on the RM's opinion.
>
> Thanks.
>
> 张铎(Duo Zhang) <pa...@gmail.com> 于2023年10月12日周四 10:47写道：
> >
> > Bump.
> >
> > There is a new CVE in zookeeper before 3.7.2.
> >
> > https://nvd.nist.gov/vuln/detail/CVE-2023-44981
> >
> > I think maybe it is time for us to bump the zookeeper version now.
> >
> > Thanks.
> >
> > 张铎(Duo Zhang) <pa...@gmail.com> 于2023年3月16日周四 18:27写道：
> > >
> > > We only use Curator in hbase-examples IIRC, so it should be OK to
> upgrade it.
> > >
> > > For ZooKeeper, besides client server wire compatibility, we also need
> to consider java compatibility. For example, different protobuf versions
> can communicate with each other, but if you depend on protobuf 2.5 and 3.x
> in the java project, you will be in trouble as the classes are different...
> > >
> > > So the question here is, if we upgrade ZooKeeper to 3.8.x, will it
> break downstream users who are still on ZooKeeper 3.6.x or 3.7.x?
> > >
> > > Thanks.
> > >
> > > Villő Szűcs <sz...@cloudera.com.invalid> 于2023年2月28日周二 22:33写道：
> > >>
> > >> Hi,
> > >> I’d like to upgrade zookeeper in hbase (and in other components as
> well) to
> > >> 3.8.1 version and curator to 5.4.0 version.
> > >> It is useful since the current zookeeper version 3.5.7 is EOL and we
> should
> > >> release HBASE 3 with the latest zookeeper to be on an active version.
> > >> ZooKeeper clients from 3.5.x onwards are fully compatible with 3.8.x
> > >> servers. ZooKeeper 3.8.x clients are compatible with 3.5.x, 3.6.x and
> 3.7.x
> > >> servers as long as we are not using new APIs not present these
> versions.
> > >> See ZooKeeper 3.8.0 Release Notes[1] for details.
> > >> Curator 5.0 contains a few non-backward compatible/breaking changes
> from
> > >> previous versions: https://curator.apache.org/breaking-changes.html,
> but
> > >> these changes have no effect on hbase. See Curator Release Notes[2]
> for
> > >> details.
> > >> Do you have any suggestions?
> > >>
> > >> [1] https://zookeeper.apache.org/doc/r3.8.0/releasenotes.html
> > >> [2] https://cwiki.apache.org/confluence/display/CURATOR/Releases
>

Re: [DISCUSS] Upgrade Zookeeper and Curator to latest version

Posted by "张铎(Duo Zhang)" <pa...@gmail.com>.
Filed https://issues.apache.org/jira/browse/HBASE-28153.

If there are no objections, I will provide a PR there to upgrade the
zookeeper version to 3.8.x on branch-2+.

For branch-2.4, I prefer we just leave it as is because soon it will be EOL.

For branch-2.5, I think it depends on the RM's opinion.

Thanks.

张铎(Duo Zhang) <pa...@gmail.com> 于2023年10月12日周四 10:47写道：
>
> Bump.
>
> There is a new CVE in zookeeper before 3.7.2.
>
> https://nvd.nist.gov/vuln/detail/CVE-2023-44981
>
> I think maybe it is time for us to bump the zookeeper version now.
>
> Thanks.
>
> 张铎(Duo Zhang) <pa...@gmail.com> 于2023年3月16日周四 18:27写道：
> >
> > We only use Curator in hbase-examples IIRC, so it should be OK to upgrade it.
> >
> > For ZooKeeper, besides client server wire compatibility, we also need to consider java compatibility. For example, different protobuf versions can communicate with each other, but if you depend on protobuf 2.5 and 3.x in the java project, you will be in trouble as the classes are different...
> >
> > So the question here is, if we upgrade ZooKeeper to 3.8.x, will it break downstream users who are still on ZooKeeper 3.6.x or 3.7.x?
> >
> > Thanks.
> >
> > Villő Szűcs <sz...@cloudera.com.invalid> 于2023年2月28日周二 22:33写道：
> >>
> >> Hi,
> >> I’d like to upgrade zookeeper in hbase (and in other components as well) to
> >> 3.8.1 version and curator to 5.4.0 version.
> >> It is useful since the current zookeeper version 3.5.7 is EOL and we should
> >> release HBASE 3 with the latest zookeeper to be on an active version.
> >> ZooKeeper clients from 3.5.x onwards are fully compatible with 3.8.x
> >> servers. ZooKeeper 3.8.x clients are compatible with 3.5.x, 3.6.x and 3.7.x
> >> servers as long as we are not using new APIs not present these versions.
> >> See ZooKeeper 3.8.0 Release Notes[1] for details.
> >> Curator 5.0 contains a few non-backward compatible/breaking changes from
> >> previous versions: https://curator.apache.org/breaking-changes.html, but
> >> these changes have no effect on hbase. See Curator Release Notes[2] for
> >> details.
> >> Do you have any suggestions?
> >>
> >> [1] https://zookeeper.apache.org/doc/r3.8.0/releasenotes.html
> >> [2] https://cwiki.apache.org/confluence/display/CURATOR/Releases