z-bb commented on PR #4565: URL: https://github.com/apache/ozone/pull/4565#issuecomment-1514077954
> The ACL checks only apply to operations on data, for example the read-only admin could read everyone's volumes, buckets, and keys. Commands to query cluster state like `ozone admin container list` also have admin checks that are not based on ACLs because they do not operate on objects in the OM. There are also admin only APIs in Recon that are read-only that would need to adjust for this setting. In scm admin protocol, total 36 types. I distinguished two types： write operations ``` AllocateContainer DeleteContainer CloseContainer AllocatePipeline ActivatePipeline DeactivatePipeline ClosePipeline ForceExitSafeMode StartReplicationManager StopReplicationManager DecommissionNodes RecommissionNodes StartMaintenanceNodes StartContainerBalancer StopContainerBalancer FinalizeScmUpgrade ResetDeletedBlockRetryCount ``` read operations ``` GetContainer GetContainerWithPipeline ListContainer QueryNode ListPipelines GetScmInfo InSafeMode GetReplicationManagerStatus GetPipeline GetContainerWithPipelineBatch GetSafeModeRuleStatuses DatanodeUsageInfo GetExistContainerWithPipelinesInBatch GetContainerToken GetContainerBalancerStatus QueryUpgradeFinalizationProgress GetContainerCount GetContainerReplicas GetReplicationManagerReport ``` I think read operations can be done through super read users or super read groups. do you think -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
