ZooKeeper ACLs Best Practices: ZooKeeper
You must follow the best practices for tightening the ZooKeeper ACLs or permissions for ZooKeeper when provisioning a secure cluster.
-
ZooKeeper Usage:
-
/zookeeper- node stores metadata of ZooKeeper itself. -
/zookeeper/quotastores quota information. In the Apache ZooKeeper 3.5 release line. -
/zookeeper/configstores dynamic reconfiguration information, but this is not applicable to HDP, which bases its ZooKeeper release off of the Apache ZooKeeper 3.4 release line.
-
-
Default ACLs:
-
/zookeeper-world:anyone:cdrwa
-
-
Security Best Practice ACLs/Permissions and Required Steps:
The following steps must be manually performed by users who are using the ZooKeeper quota feature. Components in HDP do not use this feature by default -- most users do not need to execute the following commands.-
/zookeeper-sasl:zookeeper:cdrwa -
setAcl sasl:zookeeper:rwcda
-