Github user rmetzger commented on a diff in the pull request:
https://github.com/apache/flink/pull/1342#discussion_r44764775
--- Diff: flink-yarn/src/main/java/org/apache/flink/yarn/Utils.java ---
@@ -135,7 +138,54 @@ public static void setTokensFor(ContainerLaunchContext
amContainer, Path[] paths
ByteBuffer securityTokens = ByteBuffer.wrap(dob.getData(), 0,
dob.getLength());
amContainer.setTokens(securityTokens);
}
-
+
+ /**
+ * Obtain Kerberos security token for HBase.
+ */
+ private static void obtainTokenForHBase(Credentials credentials,
Configuration conf) throws IOException {
+ if (UserGroupInformation.isSecurityEnabled()) {
+ LOG.info("Attempting to obtain Kerberos security token
for HBase");
+ try {
+ // ----
+ // Intended call:
HBaseConfiguration.addHbaseResources(conf);
+ Class
+
.forName("org.apache.hadoop.hbase.HBaseConfiguration")
+ .getMethod("addHbaseResources",
Configuration.class )
+ .invoke(null, conf);
+ // ----
+
+ LOG.info("HBase security setting: {}",
conf.get("hbase.security.authentication"));
+
+ if
(!"kerberos".equals(conf.get("hbase.security.authentication"))) {
+ LOG.info("HBase has not been configured
to use Kerberos.");
+ return;
+ }
+
+ LOG.info("Obtaining Kerberos security token for
HBase");
+ // ----
+ // Intended call:
Token<AuthenticationTokenIdentifier> token = TokenUtil.obtainToken(conf);
+ Token<?> token = (Token<?>) Class
+
.forName("org.apache.hadoop.hbase.security.token.TokenUtil")
+ .getMethod("obtainToken",
Configuration.class)
+ .invoke(null, conf);
+ // ----
+
+ if (token == null) {
+ LOG.error("No Kerberos security token
for HBase available");
+ return;
+ }
+
+ credentials.addToken(token.getService(), token);
+ LOG.info("Added HBase Kerberos security token
to credentials.");
+ } catch ( ClassNotFoundException
+ | NoSuchMethodException
+ | IllegalAccessException
+ | InvocationTargetException e) {
+ LOG.info("HBase is not available (not packaged
with this application).");
--- End diff --
Maybe it makes sense to add the exception to the log message (or even the
full stack trace), so that users have a better understanding what exactly went
wrong (for example hbase version mismatch)
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
