Re: Role for splitVector command not requiring admin?

[btiernay]

I guess not many folks are familiar with this command. Any insight from mongo devs would be greatly appreciated.

Thanks again,

Bob

On Wednesday, 15 May 2013 11:45:53 UTC-4, btiernay wrote:

Hi all,

I'm using the great mongo-hadoop project to integrate MongoDB with Hadoop, and all is working well. However, the library uses the splitVector command to calculate collection splits based on the requested mongo.input.split_size. This command in turn requires admin access. 

However, this becomes an Ops / IT issue since we shouldn't be running our apps as admin. Is there any role that I can use in order to be allowed to issue this command without being an admin?

Thanks in advance!

Bob

[Bernie Hackett]

In MongoDB 2.4 you could use the clusterAdmin role to limit things a bit. You may want to open a ticket against the Hadoop Integration project about this:

https://jira.mongodb.org/browse/HADOOP

--
--
You received this message because you are subscribed to the Google
Groups "mongodb-user" group.
To post to this group, send email to mongod...@googlegroups.com
To unsubscribe from this group, send email to
mongodb-user...@googlegroups.com
See also the IRC channel -- freenode.net#mongodb
 
---
You received this message because you are subscribed to the Google Groups "mongodb-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mongodb-user...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[btiernay]

Hey Bernie,

Thanks for info. It does look like the clusterAdmin role may help the situation slightly. However, it seems pretty close to the admin privilege in terms of its destructive possibilities. But it's a step in the right direction.

I'm not sure what the nature of a ticket against the mongo-hadoop project would be. It really is more of a problem with the mongo side of things as far as I can tell. I don't really think they can avoid the use of splitVector here. I think the more sensible thing would be to make this a "normal" operation against a db.

Cheers,

Bob

[Mike O'Brien]

Hey Bob,

The splitVector command is required to split non-sharded collections, and unfortunately it is restricted to admin users.

A couple of alternative solutions that don't require admin:

- If the collection is small and you can deal without the parallelism of multiple splits, you can turn off input splitting and deal with the whole collection at once in a single split, by setting mongo.input.split.create_input_splits to false.

- If you can shard the collection, the chunk ranges on the shards are used as split boundaries. Then the splitVector command is no longer needed, and all thats required is read permission on the chunks collection.