Zookeeper启用ACL之后hbase服务无法重启

1.zookeeper设置根目录acl：

addauth digest wkz:123

setAcl / auth:wkz:123:cdrwa

getAcl /

2. 重启hbase master报错如下：

ERROR [main] master.HMasterCommandLine: Master exiting
java.lang.RuntimeException: Failed construction of Master: class org.apache.hadoop.hbase.master.HMaster.
at org.apache.hadoop.hbase.master.HMaster.constructMaster(HMaster.java:2506)
at org.apache.hadoop.hbase.master.HMasterCommandLine.startMaster(HMasterCommandLine.java:231)
at org.apache.hadoop.hbase.master.HMasterCommandLine.run(HMasterCommandLine.java:137)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:70)
at org.apache.hadoop.hbase.util.ServerCommandLine.doMain(ServerCommandLine.java:127)
at org.apache.hadoop.hbase.master.HMaster.main(HMaster.java:2516)
Caused by: org.apache.hadoop.hbase.ZooKeeperConnectionException: master:60001-0x1690a1ae4220689, quorum=10.161.48.91:2181,10.161.48.
92:2181,10.161.48.93:2181, baseZNode=/hbase Unexpected KeeperException creating base node
at org.apache.hadoop.hbase.zookeeper.ZooKeeperWatcher.createBaseZNodes(ZooKeeperWatcher.java:206)
at org.apache.hadoop.hbase.zookeeper.ZooKeeperWatcher.<init>(ZooKeeperWatcher.java:187)
at org.apache.hadoop.hbase.regionserver.HRegionServer.<init>(HRegionServer.java:586)
at org.apache.hadoop.hbase.master.HMaster.<init>(HMaster.java:424)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.apache.hadoop.hbase.master.HMaster.constructMaster(HMaster.java:2499)
... 5 more
Caused by: org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /hbase
at org.apache.zookeeper.KeeperException.create(KeeperException.java:113)
at org.apache.zookeeper.KeeperException.create(KeeperException.java:51)
at org.apache.zookeeper.ZooKeeper.create(ZooKeeper.java:783)
at org.apache.hadoop.hbase.zookeeper.RecoverableZooKeeper.createNonSequential(RecoverableZooKeeper.java:565)
at org.apache.hadoop.hbase.zookeeper.RecoverableZooKeeper.create(RecoverableZooKeeper.java:544)
at org.apache.hadoop.hbase.zookeeper.ZKUtil.createWithParents(ZKUtil.java:1204)
at org.apache.hadoop.hbase.zookeeper.ZKUtil.createWithParents(ZKUtil.java:1182)
at org.apache.hadoop.hbase.zookeeper.ZooKeeperWatcher.createBaseZNodes(ZooKeeperWatcher.java:194)
... 13 more

3. case回复如下（case意思是不启用kerberos，无法实现我说的配置hbase通过zk acl验证的功能）

Case#: 275594

Comment From: David Wang

感谢您接听我的电话，王先生。

在电话上您向我介绍，有漏洞扫描软件检查到了Zookeeper有安全隐患，所以您在Zookeeper的znode "/"上设置了相关的权限，所以导致Hbase起不起来。

我向您介绍了，Zookeeper是用来存放一些信息的地方，相关的权限应该由使用它的application来自动设置。比如您想启用ACL在/hbase上的话，您应该参照文档[1]，在Hbase上启动Kerberos，相应的znode "/hbase"会自动重建，同时相关的ACL权限也会自动赋好。

接下来，您会将您所做的修改还原，请您告知我们Hbase是否可以正常启动。

Regards

David

[1] https://www.cloudera.com/documentation/enterprise/5-13-x/topics/cdh_sg_hbase_authentication.html

-----------------

To view the case and comment online, go to

https://cloudera-portal.force.com/50034000018Zkg3