ramackri opened a new pull request, #1155: URL: https://github.com/apache/ranger/pull/1155
## Summary Fixes intermittent `plugins-docker-build` CI failures where `ozone-datanode` exits during Kerberos login before the Ranger KDC is fully ready in the Docker Compose smoke stack. Example failure: https://github.com/apache/ranger/actions/runs/31185432016/job/93444713551 Root cause: Ozone datanode/scm started on `ranger-kdc: service_started` while Java Kerberos clients probe KDC over UDP first; the existing KDC healthcheck only validated TCP port 88. Re-running the job usually passes once the KDC is warm. ## Changes - **KDC healthcheck** (`Dockerfile.ranger-kdc`): replace TCP `nc` probe with `kinit` using the datanode keytab so healthy means Kerberos actually works - **Compose ordering** (`docker-compose.ranger-ozone.yml`): Ozone datanode/scm/om wait for `ranger-kdc: service_healthy` (same pattern as `ranger-zk`) - **krb5.conf**: set `udp_preference_limit = 0` to avoid UDP `PortUnreachableException` in Docker CI when TCP is ready first - **Startup script** (`ozone-service-start.sh`): wait for keytab file and KDC reachability before starting Ozone SCM/datanode - **Restart policy**: `restart: on-failure:3` on ozone-datanode and ozone-scm for one-shot race recovery - **CI workflow** (`.github/workflows/ci.yml`): explicit wait for `ranger-kdc` healthy before the container status check ## Test plan - [ ] `plugins-docker-build` passes on this PR (watch for multiple consecutive green runs) - [ ] Local smoke: `cd dev-support/ranger-docker && docker compose ... -f docker-compose.ranger-ozone.yml up -d` — verify `ozone-datanode`, `ozone-scm`, `ozone-om` stay running - [ ] Confirm `docker inspect ranger-kdc` reports `healthy` only after keytabs are provisioned - [ ] Verify unrelated plugin containers (Hadoop, Hive, HBase, Kafka, Knox) still start normally https://issues.apache.org/jira/browse/RANGER-5744 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
