[
https://issues.apache.org/jira/browse/HIVE-29802?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103323#comment-18103323
]
László Bodor commented on HIVE-29802:
-------------------------------------
merged to master, thanks [~gfarkas] for the patch!
> ProactiveEviction fails with InvalidACLException in Kerberos-enabled
> environments when LLAP daemons are not running
> -------------------------------------------------------------------------------------------------------------------
>
> Key: HIVE-29802
> URL: https://issues.apache.org/jira/browse/HIVE-29802
> Project: Hive
> Issue Type: Bug
> Components: llap
> Reporter: Gergely Farkas
> Assignee: Gergely Farkas
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.3.0
>
>
> When Hive is configured with Kerberos authentication
> (hive.zookeeper.kerberos.enabled=true) and no LLAP daemons have started yet,
> DDL operations such as DROP DATABASE fail with an unhandled RuntimeException.
> Root cause:
> HS2 connects to ZooKeeper without SASL authentication
> ({{LlapZookeeperRegistryImpl}} passes {{saslLoginContextName=null}} for
> non-daemon clients). When no LLAP daemons are registered, the ZK paths (e.g.
> {{/llap-sasl/user-hive}}) do not exist. The {{PathChildrenCache}} (configured
> with {{setCreateParentNodes=true}}) attempts to create them using
> {{CREATOR_ALL_ACL}}, which requires an authenticated identity. ZooKeeper
> rejects this with {{InvalidACLException}}.
> {{ZkRegistryBase.ensureInstancesCache()}} wraps this as a generic
> {{IOException}}, which propagates up through {{ProactiveEviction.evict()}} as
> an uncaught {{RuntimeException}}, causing the calling DDL operation to fail.
> Expected behavior:
> If no LLAP daemons are registered, proactive cache eviction should be a no-op
> - there is nothing cached to evict.
> Stack trace:
> {noformat}
> java.lang.RuntimeException: java.io.IOException:
> org.apache.zookeeper.KeeperException$InvalidACLException: KeeperErrorCode =
> InvalidACL for /llap-sasl/user-hive
> at
> org.apache.hadoop.hive.llap.ProactiveEviction.evict(ProactiveEviction.java:...)
> ...
> Caused by: org.apache.zookeeper.KeeperException$InvalidACLException:
> KeeperErrorCode = InvalidACL for /llap-sasl/user-hive
> at org.apache.curator.utils.ZKPaths.mkdirs(ZKPaths.java:...)
> {noformat}
> Proposed fix:
> 1. Introduce a {{ClusterNotReadyException}} (extends {{IOException}}) thrown
> by {{ZkRegistryBase.ensureInstancesCache()}} when the cluster is not ready
> due to {{InvalidACLException}}.
> 2. Catch {{ClusterNotReadyException}} in {{ProactiveEviction.evict()}} and
> return silently.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
