Authentication and authorization

Authentication verifies client identities during direct Remote Procedure Call (RPC) communication with DataNodes, while authorization controls which users are permitted to perform Disk Balancer administrative operations.

Disk Balancer CLI commands communicate directly with DataNodes through RPC. SCM is used to discover active datanodes, but does not participate in the actual Disk Balancer control operations.

Authentication

In secure clusters using Kerberos, the DataNode principal must be properly configured for RPC authentication in ozone-site.xml so the client can verify the DataNode's identity:

<property>
  <name>hdds.datanode.kerberos.principal</name>
  <value>dn/[***_HOST***]@REALM.TLD</value>
</property>

where, [***_HOST***] is the DataNode service principal. Each DataNode will substitute [***_HOST***] with its own fully qualified hostname at startup. The [***_HOST***] placeholder allows using the same configuration setting on all DataNodes.

Authorization

The Datanode performs authorization checks based on the ozone.administrators property.

Admin operations (start, stop, and update): Require the authenticated user to be listed in ozone.administrators property or a group inside ozone.administrators.groups property. By default (if unconfigured), only the OS user running the Datanode daemon possesses administrative access.
Read-only operations (status and report): Do not require administrator privileges. Any authenticated user can monitor Disk Balancer status and generate reports.

Enabling authorization for additional users:

To allow other users to perform Disk Balancer administrator operations (start, stop, update), configure the ozone.administrators property in ozone-site.xml.

Examples:

For authorizing single user,

<property>
  <name>ozone.administrators</name>
  <value>scm</value>
</property>

For authorizing multiple single users,

<property>
  <name>ozone.administrators</name>
  <value>scm,hdfs</value>
</property>

For authorizing groups,

<property>
  <name>ozone.administrators.groups</name>
  <value>ozone-admins,cluster-operators</value>
</property>