[
https://issues.apache.org/jira/browse/HADOOP-19906?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18091371#comment-18091371
]
ASF GitHub Bot commented on HADOOP-19906:
-----------------------------------------
pan3793 commented on PR #8522:
URL: https://github.com/apache/hadoop/pull/8522#issuecomment-4795344080
> This is complex but oracle are forcing it on us, and the path doesn't get
exercised until java25, so it'll be left for people testing hadoop 3.5.1+ on
java25 to find bugs asap.
@stoty actually pointed out this issue years ago, but I didn't realize its
severity at the time. I had verified that Spark on YARN ran correctly on a
Kerberos-enabled Hadoop cluster using JDK 25, so I concluded that Spark was
unaffected; it wasn't until I recently tried running Spark on K8s that I
discovered this change presented a much trickier problem than I had thought.
(PR's description "How was this patch tested?" section explains why this
happens in detail)
@steveloughran, that's true. I verified this patch in our internal Spark and
Hadoop forks with both Spark on YARN and K8s workloads, but not sure if I
missed any edge cases.
If we agree with this direction, I am going to revert the
`SubjectInheritingThread` related code. And there are some open questions:
- Should `SubjectInheritingThread` itself be removed? (1) It was designed as
a public API and has been released in 3.5.0, but it is not necessary after this
patch. (2) The implementation has a semantic issue - HADOOP-19907
SubjectInheritingThread should capture Subject in constructor instead of
start(), if we want to keep it, we must fix this issue.
- Someone requested backporting this patch to branch-3.4 (see comments at
the end of HADOOP-19486), do we want to do this?
> Alternative to SubjectInheritingThread to restore Subject propagation
> ---------------------------------------------------------------------
>
> Key: HADOOP-19906
> URL: https://issues.apache.org/jira/browse/HADOOP-19906
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 3.5.0, 3.4.3
> Reporter: Cheng Pan
> Priority: Major
> Labels: pull-request-available
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
