org.apache.hadoop.hbase.security.access

Class CoprocessorWhitelistMasterObserver

java.lang.Object

org.apache.hadoop.hbase.security.access.CoprocessorWhitelistMasterObserver

All Implemented Interfaces:

Coprocessor, MasterCoprocessor, MasterObserver

@InterfaceAudience.LimitedPrivate(value="Configuration")
public class CoprocessorWhitelistMasterObserver
extends Object
implements MasterCoprocessor, MasterObserver

Master observer for restricting coprocessor assignments.

Nested Class Summary

Nested classes/interfaces inherited from interface org.apache.hadoop.hbase.Coprocessor

Coprocessor.State

Field Summary

Fields

Modifier and Type	Field and Description
static String	CP_COPROCESSOR_WHITELIST_PATHS_KEY
private static org.slf4j.Logger	LOG

Fields inherited from interface org.apache.hadoop.hbase.Coprocessor

PRIORITY_HIGHEST, PRIORITY_LOWEST, PRIORITY_SYSTEM, PRIORITY_USER, VERSION

Constructor Summary

Constructors

Constructor and Description
CoprocessorWhitelistMasterObserver()

Method Summary

Modifier and Type	Method and Description
Optional<MasterObserver>	getMasterObserver()
void	preCreateTable(ObserverContext<MasterCoprocessorEnvironment> ctx, TableDescriptor htd, RegionInfo[] regions) Called before a new table is created by HMaster.
TableDescriptor	preModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx, TableName tableName, TableDescriptor currentDesc, TableDescriptor newDesc) Called prior to modifying a table's properties.
private static boolean	validatePath(org.apache.hadoop.fs.Path coprocPath, org.apache.hadoop.fs.Path wlPath) Validates a single whitelist path against the coprocessor path
private static void	verifyCoprocessors(ObserverContext<MasterCoprocessorEnvironment> ctx, TableDescriptor htd) Perform the validation checks for a coprocessor to determine if the path is white listed or not.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.hadoop.hbase.Coprocessor

getServices, start, stop

Methods inherited from interface org.apache.hadoop.hbase.coprocessor.MasterObserver

postAbortProcedure, postAddReplicationPeer, postAddRSGroup, postAssign, postBalance, postBalanceRSGroup, postBalanceSwitch, postClearDeadServers, postCloneSnapshot, postCompletedCreateTableAction, postCompletedDeleteTableAction, postCompletedDisableTableAction, postCompletedEnableTableAction, postCompletedMergeRegionsAction, postCompletedModifyTableAction, postCompletedModifyTableAction, postCompletedSplitRegionAction, postCompletedTruncateTableAction, postCreateNamespace, postCreateTable, postDecommissionRegionServers, postDeleteNamespace, postDeleteSnapshot, postDeleteTable, postDisableReplicationPeer, postDisableTable, postEnableReplicationPeer, postEnableTable, postGetClusterMetrics, postGetLocks, postGetNamespaceDescriptor, postGetProcedures, postGetReplicationPeerConfig, postGetTableDescriptors, postGetTableNames, postGetUserPermissions, postGrant, postHasUserPermissions, postIsRpcThrottleEnabled, postListDecommissionedRegionServers, postListNamespaceDescriptors, postListReplicationPeers, postListSnapshot, postLockHeartbeat, postMergeRegions, postMergeRegionsCommitAction, postModifyNamespace, postModifyNamespace, postModifyTable, postModifyTable, postMove, postMoveServers, postMoveServersAndTables, postMoveTables, postRecommissionRegionServer, postRegionOffline, postRemoveReplicationPeer, postRemoveRSGroup, postRemoveServers, postRequestLock, postRestoreSnapshot, postRevoke, postRollBackMergeRegionsAction, postRollBackSplitRegionAction, postSetNamespaceQuota, postSetRegionServerQuota, postSetSplitOrMergeEnabled, postSetTableQuota, postSetUserQuota, postSetUserQuota, postSetUserQuota, postSnapshot, postStartMaster, postSwitchExceedThrottleQuota, postSwitchRpcThrottle, postTableFlush, postTruncateTable, postUnassign, postUpdateReplicationPeerConfig, preAbortProcedure, preAddReplicationPeer, preAddRSGroup, preAssign, preBalance, preBalanceRSGroup, preBalanceSwitch, preClearDeadServers, preCloneSnapshot, preCreateNamespace, preCreateTableAction, preCreateTableRegionsInfos, preDecommissionRegionServers, preDeleteNamespace, preDeleteSnapshot, preDeleteTable, preDeleteTableAction, preDisableReplicationPeer, preDisableTable, preDisableTableAction, preEnableReplicationPeer, preEnableTable, preEnableTableAction, preGetClusterMetrics, preGetLocks, preGetNamespaceDescriptor, preGetProcedures, preGetReplicationPeerConfig, preGetTableDescriptors, preGetTableNames, preGetUserPermissions, preGrant, preHasUserPermissions, preIsRpcThrottleEnabled, preListDecommissionedRegionServers, preListNamespaceDescriptors, preListReplicationPeers, preListSnapshot, preLockHeartbeat, preMasterInitialization, preMergeRegions, preMergeRegionsAction, preMergeRegionsCommitAction, preModifyNamespace, preModifyNamespace, preModifyTable, preModifyTableAction, preModifyTableAction, preMove, preMoveServers, preMoveServersAndTables, preMoveTables, preRecommissionRegionServer, preRegionOffline, preRemoveReplicationPeer, preRemoveRSGroup, preRemoveServers, preRequestLock, preRestoreSnapshot, preRevoke, preSetNamespaceQuota, preSetRegionServerQuota, preSetSplitOrMergeEnabled, preSetTableQuota, preSetUserQuota, preSetUserQuota, preSetUserQuota, preShutdown, preSnapshot, preSplitRegion, preSplitRegionAction, preSplitRegionAfterMETAAction, preSplitRegionBeforeMETAAction, preStopMaster, preSwitchExceedThrottleQuota, preSwitchRpcThrottle, preTableFlush, preTruncateTable, preTruncateTableAction, preUnassign, preUpdateReplicationPeerConfig

Field Detail

CP_COPROCESSOR_WHITELIST_PATHS_KEY

public static final String CP_COPROCESSOR_WHITELIST_PATHS_KEY

See Also:

Constant Field Values

LOG

private static final org.slf4j.Logger LOG

Constructor Detail

CoprocessorWhitelistMasterObserver

public CoprocessorWhitelistMasterObserver()

Method Detail

getMasterObserver

public Optional<MasterObserver> getMasterObserver()

Specified by:

getMasterObserver in interface MasterCoprocessor

preModifyTable

public TableDescriptor preModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                      TableName tableName,
                                      TableDescriptor currentDesc,
                                      TableDescriptor newDesc)
                               throws IOException

Description copied from interface: MasterObserver

Called prior to modifying a table's properties. Called as part of modify table RPC call.

Specified by:

preModifyTable in interface MasterObserver

Parameters:

ctx - the environment to interact with the framework and master

tableName - the name of the table

currentDesc - current TableDescriptor of the table

newDesc - after modify operation, table will have this descriptor

Throws:

IOException

preCreateTable

public void preCreateTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
                           TableDescriptor htd,
                           RegionInfo[] regions)
                    throws IOException

Description copied from interface: MasterObserver

Called before a new table is created by HMaster. Called as part of create table RPC call.

Specified by:

preCreateTable in interface MasterObserver

Parameters:

ctx - the environment to interact with the framework and master

htd - the TableDescriptor for the table

regions - the initial regions created for the table

Throws:

IOException

validatePath

private static boolean validatePath(org.apache.hadoop.fs.Path coprocPath,
                                    org.apache.hadoop.fs.Path wlPath)

Validates a single whitelist path against the coprocessor path

Parameters:

coprocPath - the path to the coprocessor including scheme

wlPath - can be: 1) a "*" to wildcard all coprocessor paths 2) a specific filesystem (e.g. hdfs://my-cluster/) 3) a wildcard path to be evaluated by FilenameUtils.wildcardMatch(String, String) path can specify scheme or not (e.g. "file:///usr/hbase/coprocessors" or for all filesystems "/usr/hbase/coprocessors")

Returns:

if the path was found under the wlPath

verifyCoprocessors

private static void verifyCoprocessors(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                       TableDescriptor htd)
                                throws IOException

Perform the validation checks for a coprocessor to determine if the path is white listed or not.

Parameters:

ctx - as passed in from the coprocessor

htd - as passed in from the coprocessor

Throws:

IOException - if path is not included in whitelist or a failure occurs in processing