[ https://issues.apache.org/jira/browse/KUDU-2265?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Hao Hao updated KUDU-2265: -------------------------- Resolution: Fixed Fix Version/s: 1.7.0 Status: Resolved (was: In Review) > A non-leader master uses self-signed server TLS cert if it hasn't ever run as > a leader > -------------------------------------------------------------------------------------- > > Key: KUDU-2265 > URL: https://issues.apache.org/jira/browse/KUDU-2265 > Project: Kudu > Issue Type: Improvement > Components: master, security > Affects Versions: 1.3.0, 1.3.1, 1.4.0, 1.6.0, 1.50 > Reporter: Alexey Serbin > Assignee: Alexey Serbin > Priority: Major > Fix For: 1.7.0 > > > As it's currently implemented, master process replaces its auto-generated > self-signed server TLS certificate with CA-signed one only when it becomes a > leader (see {{{color:#333333}CatalogManager::InitCertAuthorityWith(){color}}} > method; it's invoked only from \{{CatalogManager::InitCertAuthority()}}, that > is invoked only from \{{CatalogManager::PrepareForLeadershipTask()}}). > > In case of just one Raft election from the start (which is pretty common, > BTW), non-leader masters run without CA-signed server certificate for a long > time in case of a multi-master configuration. That causes clients to not use > their authn tokens for authentication while connecting to those non-leader > masters. In case of Spark applications where executors do not have Kerberos > credentials (the common case), application logs are polluted with messages > like below: > {noformat} > org.apache.kudu.client.NonRecoverableException: Server requires Kerberos, but > this client is not authenticated (kinit) > at org.apache.kudu.client.Negotiator.evaluateChallenge(Negotiator.java:705) > at org.apache.kudu.client.Negotiator.sendSaslInitiate(Negotiator.java:581) > ... > Caused by: javax.security.sasl.SaslException: GSS initiate failed [Caused by > GSSException: No valid credentials provided (Mechanism level: Failed to find > any Kerberos tgt)] > at > com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211){noformat} -- This message was sent by Atlassian JIRA (v7.6.3#76005)