Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Fri, 19 May 2017 20:56:04 +0000 (UTC)
From: "Yongjun Zhang (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.13073541.1495221469000.253326.1495227364059@Atlassian.JIRA>
In-Reply-To: <JIRA.13073541.1495221469000@Atlassian.JIRA>
References: <JIRA.13073541.1495221469000@Atlassian.JIRA> <JIRA.13073541.1495221469639@jira-lw-us.apache.org>
Subject: [jira] [Commented] (HADOOP-14441)
 LoadBalancingKMSClientProvider#addDelegationTokens should add delegation
 tokens from all KMS instances
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 19 May 2017 20:56:08 -0000


    [ https://issues.apache.org/jira/browse/HADOOP-14441?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16017994#comment-16017994 ] 

Yongjun Zhang commented on HADOOP-14441:
----------------------------------------

But I don't see the catch/retry in Hadoop code. Do we expect client code to do so? It seems we should do it within Hadoop. [~jojochuang].
 

> LoadBalancingKMSClientProvider#addDelegationTokens should add delegation tokens from all KMS instances
> ------------------------------------------------------------------------------------------------------
>
>                 Key: HADOOP-14441
>                 URL: https://issues.apache.org/jira/browse/HADOOP-14441
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: kms
>    Affects Versions: 2.7.0
>         Environment: CDH5.7.4, Kerberized, SSL, KMS-HA, at rest encryption
>            Reporter: Wei-Chiu Chuang
>            Assignee: Wei-Chiu Chuang
>         Attachments: HADOOP-14441.001.patch, HADOOP-14441.002.patch
>
>
> LoadBalancingKMSClientProvider only gets delegation token from one KMS instance, in a round-robin fashion. This is arguably a bug, as JavaDoc for {{KeyProviderDelegationTokenExtension#addDelegationTokens}} states:
> {quote}
> /**
>      * The implementer of this class will take a renewer and add all
>      * delegation tokens associated with the renewer to the 
>      * <code>Credentials</code> object if it is not already present, 
> ...
> **/
> {quote}
> This bug doesn't pop up very often, because HDFS clients such as MapReduce unintentionally calls {{FileSystem#addDelegationTokens}} multiple times.
> We have a custom client that accesses HDFS/KMS-HA using delegation token, and we were puzzled why it always throws "Failed to find any Kerberos tgt" exceptions talking to one KMS but not the other. Turns out that client couldn't talk to the KMS because {{FileSystem#addDelegationTokens}} only gets one KMS delegation token at a time.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org