anmolanmol1234 opened a new pull request, #8607:
URL: https://github.com/apache/hadoop/pull/8607

   Customers running Spark and Hadoop workloads on ADLS Gen2 with an RBAC-only 
authorization model (no ACLs assigned, all data access governed by Azure RBAC 
role assignments) are frequently blocked by framework-generated setPermission() 
calls.
   
   setPermission() is invoked implicitly by:
   
   Hadoop commit protocols (v1 and v2)
   Spark's FileOutputCommitter on job commit
   distcp when preserving permissions
   Hive/Impala when writing partitions
   Various other job-orchestration paths
   
   On HNS-enabled accounts, setPermission() translates to a SetAccessControl 
request on the ADLS Gen2 REST surface, which requires ACL-management 
permissions 
(Microsoft.Storage/storageAccounts/blobServices/containers/blobs/manageOwnership/action
 or equivalent via a POSIX ACL entry granting the caller ACL modification 
rights).
   
   In RBAC-only deployments, callers typically have full data-plane RBAC roles 
(e.g. Storage Blob Data Contributor) but do not have — and by design do not 
want — ACL-management permissions. As a result, these framework-generated 
setPermission() calls fail with 403 AuthorizationPermissionMismatch, breaking 
otherwise well-configured workloads.
   
   There is currently no way to disable this driver-side behavior without also 
disabling the explicit ACL management APIs, which some customers still rely on.
   
   Proposed change :- 
   
   Introduce an opt-in ABFS configuration:
   <property>
   <name>fs.azure.rbac.only</name>
   <value>true</value>
   
   </property>
   When enabled on an HNS-enabled account, AzureBlobFileSystem#setPermission() 
is treated as a pure no-op: the call returns successfully without contacting 
the backend.
   
   Disabled by default — no behavior change for existing deployments.
   HNS-only — on non-HNS accounts the flag has no effect; existing driver 
semantics are preserved.
   Scoped strictly to setPermission() — no other API is gated by this flag.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to