Gergely Farkas created HIVE-29802:
-------------------------------------
Summary: ProactiveEviction fails with InvalidACLException in
Kerberos-enabled environments when LLAP daemons are not running
Key: HIVE-29802
URL: https://issues.apache.org/jira/browse/HIVE-29802
Project: Hive
Issue Type: Bug
Components: llap
Reporter: Gergely Farkas
Assignee: Gergely Farkas
When Hive is configured with Kerberos authentication
(hive.zookeeper.kerberos.enabled=true) and no LLAP daemons have started yet,
DDL operations such as DROP DATABASE fail with an unhandled RuntimeException.
Root cause:
HS2 connects to ZooKeeper without SASL authentication
({{LlapZookeeperRegistryImpl}} passes {{saslLoginContextName=null}} for
non-daemon clients). When no LLAP daemons are registered, the ZK paths (e.g.
{{/llap-sasl/user-hive}}) do not exist. The {{PathChildrenCache}} (configured
with {{setCreateParentNodes=true}}) attempts to create them using
{{CREATOR_ALL_ACL}}, which requires an authenticated identity. ZooKeeper
rejects this with {{InvalidACLException}}.
{{ZkRegistryBase.ensureInstancesCache()}} wraps this as a generic
{{IOException}}, which propagates up through {{ProactiveEviction.evict()}} as
an uncaught {{RuntimeException}}, causing the calling DDL operation to fail.
Expected behavior:
If no LLAP daemons are registered, proactive cache eviction should be a no-op -
there is nothing cached to evict.
Stack trace:
{noformat}
java.lang.RuntimeException: java.io.IOException:
org.apache.zookeeper.KeeperException$InvalidACLException: KeeperErrorCode =
InvalidACL for /llap-sasl/user-hive
at
org.apache.hadoop.hive.llap.ProactiveEviction.evict(ProactiveEviction.java:...)
...
Caused by: org.apache.zookeeper.KeeperException$InvalidACLException:
KeeperErrorCode = InvalidACL for /llap-sasl/user-hive
at org.apache.curator.utils.ZKPaths.mkdirs(ZKPaths.java:...)
{noformat}
Proposed fix:
1. Introduce a {{ClusterNotReadyException}} (extends {{IOException}}) thrown by
{{ZkRegistryBase.ensureInstancesCache()}} when the cluster is not ready due to
{{InvalidACLException}}.
2. Catch {{ClusterNotReadyException}} in {{ProactiveEviction.evict()}} and
return silently.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
