Mostafa Mokhtar created IMPALA-6770:
---------------------------------------
Summary: Catalog service should retry connecting to Sentry similar
to HMS
Key: IMPALA-6770
URL: https://issues.apache.org/jira/browse/IMPALA-6770
Project: IMPALA
Issue Type: Improvement
Components: Catalog
Affects Versions: Impala 2.12.0
Reporter: Mostafa Mokhtar
If the Catalog service fails to connect to Sentry at startup it doesn't retry,
if the Sentry service becomes available later on the Catalog needs a restart to
connect.
{code}
0329 12:08:21.547955 128362 RetryClientInvocationHandler.java:99] failed to
execute listRoles
Java exception follows:
java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor12.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
sentry.org.apache.sentry.core.common.transport.RetryClientInvocationHandler.invokeImpl(RetryClientInvocationHandler.java:95)
at
sentry.org.apache.sentry.core.common.transport.SentryClientInvocationHandler.invoke(SentryClientInvocationHandler.java:41)
at com.sun.proxy.$Proxy14.listRoles(Unknown Source)
at
org.apache.impala.util.SentryPolicyService.listAllRoles(SentryPolicyService.java:393)
at
org.apache.impala.util.SentryProxy.checkUserSentryAdmin(SentryProxy.java:215)
at
org.apache.impala.service.JniCatalog.checkUserSentryAdmin(JniCatalog.java:259)
Caused by: org.apache.sentry.provider.db.SentryAccessDeniedException: Access
denied to foo. Server Stacktrace:
org.apache.sentry.provider.db.SentryAccessDeniedException: Access denied to foo
at
org.apache.sentry.provider.db.service.thrift.SentryPolicyStoreProcessor.list_sentry_roles_by_group(SentryPolicyStoreProcessor.java:581)
at
org.apache.sentry.provider.db.service.thrift.SentryPolicyService$Processor$list_sentry_roles_by_group.getResult(SentryPolicyService.java:1077)
at
org.apache.sentry.provider.db.service.thrift.SentryPolicyService$Processor$list_sentry_roles_by_group.getResult(SentryPolicyService.java:1062)
at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
at
org.apache.sentry.provider.db.service.thrift.SentryProcessorWrapper.process(SentryProcessorWrapper.java:36)
at
org.apache.thrift.TMultiplexedProcessor.process(TMultiplexedProcessor.java:123)
at
org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:286)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
at org.apache.sentry.service.thrift.Status.throwIfNotOk(Status.java:113)
at
org.apache.sentry.provider.db.service.thrift.SentryPolicyServiceClientDefaultImpl.listRolesByGroupName(SentryPolicyServiceClientDefaultImpl.java:161)
at
org.apache.sentry.provider.db.service.thrift.SentryPolicyServiceClientDefaultImpl.listRoles(SentryPolicyServiceClientDefaultImpl.java:207)
... 9 more
I0329 12:08:21.549322 128362 jni-util.cc:230]
org.apache.impala.catalog.AuthorizationException: User 'f...@foo.com' does not
have privileges to access the requested policy metadata or Sentry Service is
unavailable.
at
org.apache.impala.util.SentryProxy.checkUserSentryAdmin(SentryProxy.java:217)
at
org.apache.impala.service.JniCatalog.checkUserSentryAdmin(JniCatalog.java:259)
I0329 12:08:21.559258 128362 status.cc:125] AuthorizationException: User
'f...@foo.com' does not have privileges to access the requested policy metadata
or Sentry Service is unavailable.
@ 0x965c1a impala::Status::Status()
@ 0xcec82d impala::JniUtil::GetJniExceptionMsg()
@ 0x956afd impala::Catalog::SentryAdminCheck()
@ 0x9490dc CatalogServiceThriftIf::SentryAdminCheck()
@ 0x9fb17e
impala::CatalogServiceProcessor::process_SentryAdminCheck()
@ 0x9fa3ff impala::CatalogServiceProcessor::dispatchCall()
@ 0x933a0a apache::thrift::TDispatchProcessor::process()
@ 0xb17949
apache::thrift::server::TAcceptQueueServer::Task::run()
@ 0xb100c9 impala::ThriftThread::RunRunnable()
@ 0xb10ec2
boost::detail::function::void_function_obj_invoker0<>::invoke()
@ 0xd5f40f impala::Thread::SuperviseThread()
@ 0xd5fc0a boost::detail::thread_data<>::run()
@ 0x12d64fa (unknown)
@ 0x7f3027e34dc5 start_thread
@ 0x7f3027b61ced __clone
E0329 12:08:21.559299 128362 catalog-server.cc:145] AuthorizationException:
User 'f...@foo.com' does not have privileges to access the requested policy
metadata or Sentry Service is unavailable.
{code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
