zk 啟用kerberos後 hbase連線不上問題

Muroidea發表於2020-09-27
ROS

背景

當cdh叢集啟動kerberos認證後. 啟動hbase是hmaster 死活起不來. 思考可能是認證問題. 使用getAcl 看hbase節點的許可權發現hbase使用者並沒有可操作的許可權. 需要給hbase增加許可權. 主要出現

 KeeperErrorCode = NoAuth for /hbase/flush-table-proc/acquired

等錯誤

流程

  • 為zk增加一個超級使用者
    • https://www.jianshu.com/p/373d52375a65
  • 使用超級使用者為hbase目錄賦權.
    • https://docs.cloudera.com/runtime/7.2.1/zookeeper-security/topics/zookeeper-acls-hbase.html
  • 重啟hbase

對應許可權賦權

Open for global read, write protected: world:anyone:r, sasl:hbase:cdrwa

setAcl -R /hbase/master world:anyone:r,sasl:hbase:cdrwa
setAcl -R /hbase/meta-region-server world:anyone:r,sasl:hbase:cdrwa
setAcl -R /hbase/hbaseid world:anyone:r,sasl:hbase:cdrwa
setAcl -R /hbase/table world:anyone:r,sasl:hbase:cdrwa
setAcl -R /hbase/rs world:anyone:r,sasl:hbase:cdrwa

No global read, r/w protected: sasl:hbase:cdrwa:

setAcl -R /hbase/acl sasl:hbase:cdrwa
setAcl -R /hbase/namespace sasl:hbase:cdrwa
setAcl -R /hbase/backup-masters sasl:hbase:cdrwa
setAcl -R /hbase/online-snapshot sasl:hbase:cdrwa
setAcl -R /hbase/draining sasl:hbase:cdrwa
setAcl -R /hbase/replication sasl:hbase:cdrwa
setAcl -R /hbase/region-in-transition sasl:hbase:cdrwa
setAcl -R /hbase/splitWAL sasl:hbase:cdrwa
setAcl -R /hbase/table-lock sasl:hbase:cdrwa
setAcl -R /hbase/recovering-regions sasl:hbase:cdrwa
setAcl -R /hbase/running sasl:hbase:cdrwa
setAcl -R /hbase/tokenauth sasl:hbase:cdrwa
setAcl -R /hbase/balancer sasl:hbase:cdrwa
setAcl -R /hbase/flush-table-proc sasl:hbase:cdrwa
setAcl -R /hbase/master-maintenance sasl:hbase:cdrwa
setAcl -R /hbase/rolllog-proc sasl:hbase:cdrwa
setAcl -R /hbase/rsgroup sasl:hbase:cdrwa
setAcl -R /hbase/switch sasl:hbase:cdrwa
  • 注意cdh6的zk 客戶端沒有-R 引數. 需要下個高版本的zk
  • 經過上面設定如果還是有問題, name只能
setAcl -R /hbase sasl:hbase:cdrwa
  • 重啟叢集后發現許可權都正常了.

參考

  • https://www.pianshen.com/article/7625305608/

相關文章