You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hbase.apache.org by "Duo Zhang (Jira)" <ji...@apache.org> on 2021/06/05 14:51:00 UTC
[jira] [Commented] (HBASE-21163) Support backup-and-restore
operations without Hbase Super user privilege
[ https://issues.apache.org/jira/browse/HBASE-21163?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17357879#comment-17357879 ]
Duo Zhang commented on HBASE-21163:
-----------------------------------
Any updates?
> Support backup-and-restore operations without Hbase Super user privilege
> ------------------------------------------------------------------------
>
> Key: HBASE-21163
> URL: https://issues.apache.org/jira/browse/HBASE-21163
> Project: HBase
> Issue Type: Improvement
> Components: backup&restore
> Reporter: Sujit P
> Assignee: Vladimir Rodionov
> Priority: Critical
> Labels: Backup/Restore
> Fix For: 3.0.0-alpha-1
>
>
> Hello Team,
> I am opening this Apache Jira to request for an analysis on considering following problem statement:
> Currently backup-and-restore utility is designed to work with "hbase" superuser privileges.
> I see at-least couple concerns on that, may be more, will add more later on:
> * For smaller organizations with less than 20 hbase tables or couple of clusters, it is manageable, hbase admins. However, for larger organizations or larger clusters, that would need providing hbase super user access to many people to manage such operations which can be a security risk on source cluster.
> * In certain scenarios, it may be typical to have one DR Cluster in remote data center to store backup tables, and having super privileges for all tables in remote cluster is another risk for same reasons above.
> I suggest to review into making backup and restore without hbase super privileges .
> Tenants or application admins may have certainly have admin access to relevant tables/namespaces/snapshots.
> Here is an example on what I am proposing from RDBMS : [https://docs.oracle.com/cd/E16926_01/doc.121/e16564/configure_users_classes.htm#OBADM144]
> Thanks
>
> PS: Forgive me if I hadn't opened my second apache Jira correct way, happy to correct it.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)