[
https://issues.apache.org/jira/browse/HBASE-29361?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17956568#comment-17956568
]
Hudson commented on HBASE-29361:
--------------------------------
Results for branch branch-2
[build #1280 on
builds.a.o|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/]:
(x) *{color:red}-1 overall{color}*
----
details (if available):
(/) {color:green}+1 general checks{color}
-- For more information [see general
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/General_20Nightly_20Build_20Report/]
(/) {color:green}+1 jdk8 hadoop2 checks{color}
-- For more information [see jdk8 (hadoop2)
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK8_20Nightly_20Build_20Report_20_28Hadoop2_29/]
(x) {color:red}-1 jdk8 hadoop3 checks{color}
-- For more information [see jdk8 (hadoop3)
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK8_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 jdk11 hadoop3 checks{color}
-- For more information [see jdk11
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK11_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 jdk17 hadoop3 checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 jdk17 hadoop 3.3.5 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 jdk17 hadoop 3.3.6 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 jdk17 hadoop 3.4.0 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 source release artifact{color}
-- Something went wrong with this stage, [check relevant console
output|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280//console].
(x) {color:red}-1 client integration test{color}
-- Something went wrong with this stage, [check relevant console
output|https://ci-hbase.apache.org/job/HBase%20Nightly/job/branch-2/1280//console].
> Snapshot coprocessor hooks called inside SnapshotProcedure
> ----------------------------------------------------------
>
> Key: HBASE-29361
> URL: https://issues.apache.org/jira/browse/HBASE-29361
> Project: HBase
> Issue Type: Bug
> Components: Coprocessors, snapshots
> Affects Versions: 2.6.0
> Reporter: Peter Somogyi
> Assignee: Peter Somogyi
> Priority: Minor
> Labels: pull-request-available
> Fix For: 2.7.0, 3.0.0-beta-2, 2.6.3
>
>
> Snapshot coprocessor hooks (e.g. preSnapshot) are called inside
> SnapshotProcedure, causing inconsistent behavior compared to
> CreateTableProcedure or other procedures.
> *Current Behavior:*
> In HBase 2.6, snapshot operations have been moved to the Procedure framework.
> However, the integration of coprocessors with snapshots differs from other
> procedures. Specifically, the preSnapshot coprocessor hook is called inside
> the SnapshotProcedure's SNAPSHOT_PRE_OPERATION step. If a coprocessor (e.g.,
> Ranger) throws an AccessDeniedException during a snapshot create command, the
> SnapshotProcedure starts and rolls back during the SNAPSHOT_PRE_OPERATION
> step.
> This is different from CreateTableProcedure, where the preCreateTable hook is
> called before the procedure itself starts.
> When the CreateTableProcedure is denied it will create a FailedProcedure,
> however, the CreateSnapshot procedure will start a SnapshotProcedure.
> *Comparison*
> Original behavior using deny coprocessor for snapshot and table create
> {noformat}
> hbase:011:0> snapshot 'peter', 'denied1'
> ERROR: Snapshot is not allowed by coprocessor
> For usage try 'help "snapshot"'
> Took 0.1669 seconds
> hbase:012:0> create 'peter1-denied', 'f'
> ERROR: org.apache.hadoop.hbase.security.AccessDeniedException: Denied table
> create
> For usage try 'help "create"'
> Took 0.0510 seconds
> hbase:013:0> list_procedures
> PID Name State Submitted Last_Update Parameters
> 88 org.apache.hadoop.hbase.master.procedure.SnapshotProcedure ROLLEDBACK
> 2025-05-28 14:18:40 +0200 2025-05-28 14:18:40 +0200 [{},
> {"snapshot"=>{"name"=>"denied1", "table"=>"peter",
> "creationTime"=>"1748434720667", "type"=>"FLUSH", "version"=>2, "ttl"=>"0"}}]
> 89 org.apache.hadoop.hbase.procedure2.FailedProcedure ROLLEDBACK 2025-05-28
> 14:18:55 +0200 2025-05-28 14:18:55 +0200
> 2 row(s)
> Took 0.0408 seconds
> hbase:014:0>
> {noformat}
> The new behavior when preSnapshot is called before the Procedure itself
> {noformat}
> hbase:001:0> snapshot 'peter', 'denied1'
> ERROR: org.apache.hadoop.hbase.security.AccessDeniedException: Snapshot is
> not allowed by coprocessor
> For usage try 'help "snapshot"'
> Took 5.3337 seconds
> hbase:002:0> create 'peter-denied', 'f'
> ERROR: org.apache.hadoop.hbase.security.AccessDeniedException: Denied table
> create
> For usage try 'help "create"'
> Took 0.0184 seconds
> hbase:003:0> list_procedures
> PID Name State Submitted Last_Update Parameters
> 102 org.apache.hadoop.hbase.procedure2.FailedProcedure ROLLEDBACK 2025-05-28
> 14:44:52 +0200 2025-05-28 14:44:52 +0200
> 103 org.apache.hadoop.hbase.procedure2.FailedProcedure ROLLEDBACK 2025-05-28
> 14:45:01 +0200 2025-05-28 14:45:01 +0200
> 2 row(s)
> Took 0.0472 seconds
> hbase:004:0>
> {noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
