[GitHub] [accumulo] EdColeman commented on pull request #3118: add option to dump Zk ACls with zoo-info-viewer

[GitBox <gi...@apache.org>]

EdColeman commented on PR #3118:
URL: https://github.com/apache/accumulo/pull/3118#issuecomment-1347014237

   I did not address what permissions are "required" for this round because I think that may be unsettled (1).  I planned on updating the upgrade section in the docs to address what to expect.
   
   (1) By unsettled, the only hard requirement is that Accumulo has full access all of the nodes, specifically that Acuumulo session has or inherits cdrwa ZooKeeper permissions.  While it seems unwise to allow others access I was not sure if we a) explicitly stated that and then b) if we could / should enforce that for 2.1.x - for 3.x, that seems a better place to lock things down if that's how we want to go.  For 2.1.x, the we might want to make suggestions, but not sure how much further we can take it without potentially breaking user code external to Accumulo.  
   
   On the other hand, this should not be public API, so maybe its not "breaking" but just a way of saying "hey, you should not have counted on that in the first place".  The places where I could see a conflict would be if there were external utilities for things like getting FATE status or potentially FATE transaction clean-up without using an authenticated session.
   
   Adding explicit checks to this code that prints a summary / violations should be easy, once it is decided what those checks should be.  Maybe is better as a follow-on if this code is accepted?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org