1. Document account authorization requirements
The directories and files on hdfs correspond to their respective kerberos accounts, and it is often necessary to grant permissions to other accounts. At this time, you can use the setfacl command to complete the corresponding requirements.
2.getfacl command
Before understanding setfacl, let's take a look at the getfacl command.
hadoop fs -getfacl filepath
# file: filepath
# owner: xxx
# group: supergroup
user::rwx
group::rwx
mask::rwx
other::rwx
As you can see, only the owner named xxx has permission for the filepath at this time.
3.setfacl command
hdfs dfs -setfacl -R -m user:zzz:r-x filepath
The above command is to grant read permission to the filepath to the account named zzz.
-R means that it takes effect recursively on the filepath and the directories and files below it.
Note that you need to add x executable permission, otherwise it will not take effect.
At this point, use the getfacl command to view
# file: filepath
# owner: xxx
# group: supergroup
user::rwx
user:zzz:r-x
group::rwx
mask::rwx
other::rwx
It has been effective for account zzz, zzz can read the filepath and the directories and files under it on hdfs.