hadoop-hdfs-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Wei-Chiu Chuang (JIRA)" <j...@apache.org>
Subject [jira] [Created] (HDFS-10799) NameNode should use loginUser(hdfs) to serve iNotify requests
Date Thu, 25 Aug 2016 18:41:20 GMT
Wei-Chiu Chuang created HDFS-10799:

             Summary: NameNode should use loginUser(hdfs) to serve iNotify requests
                 Key: HDFS-10799
                 URL: https://issues.apache.org/jira/browse/HDFS-10799
             Project: Hadoop HDFS
          Issue Type: Bug
          Components: namenode
    Affects Versions: 2.6.0
         Environment: Kerberized, HA cluster, iNotify client, CDH5.7.0
            Reporter: Wei-Chiu Chuang
            Assignee: Wei-Chiu Chuang

When a NameNode serves iNotify requests from a client, it verifies the client has superuser
permission and then uses the client's Kerberos principal to read edits from journal nodes.

However, if the client does not renew its tgt tickets, the connection from NameNode to journal
nodes may fail. In which case, the NameNode thinks the edits are corrupt, and prints a scary
error message:
"During automatic edit log failover, we noticed that all of the remaining edit log streams
are shorter than the current one!  The best remaining edit log ends at transaction 11577603,
but we thought we could read up to transaction 11577606.  If you continue, metadata will be
lost forever!"

However, the edits are actually good. NameNode _should not freak out when an iNotify client's
tgt ticket expires_.

I think that an easy solution to this bug, is that after NameNode verifies client has superuser
permission, call {{SecurityUtil.doAsLoginUser}} and then read edits. This will make sure the
operation does not fail due to an expired client ticket.

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: hdfs-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-dev-help@hadoop.apache.org

View raw message