jasonosullivan34 opened a new pull request, #11967: URL: https://github.com/apache/ozone/pull/11967
## What changes were proposed in this pull request? * Remove dnsjava exclusion from hadoop-hdds/hadoop-dependency-client/pom.xml * Add TestCliTokenServiceUseIp to hadoop-ozone/cli-admin module ### Problem Setting `hadoop.security.token.service.use_ip=false` in core-site.xml crashes Ozone CLI commands that contact the cluster with `ExceptionInInitializerError` caused by `NoClassDefFoundError: org/xbill/DNS/ResolverConfig`. Local commands that do not bootstrap a client (such as `ozone sh --help`) are unaffected. ### Root Cause 1. CLI commands that communicate with the cluster construct an `RpcClient`, which invokes `UserGroupInformation.getCurrentUser()` during client bootstrap. 2. Initializing `UserGroupInformation` calls `SecurityUtil.getAuthenticationMethod()`, triggering the static initializer of `SecurityUtil`. 3. With `hadoop.security.token.service.use_ip=false` configured, `SecurityUtil`'s static block executes `setTokenServiceUseIp(false)`, which instantiates `QualifiedHostResolver`. 4. `QualifiedHostResolver` requires `org.xbill.DNS.ResolverConfig` from `dnsjava`. 5. `hdds-hadoop-dependency-client` explicitly excludes `dnsjava` from `hadoop-common`. Because CLI modules inherit through this dependency tree without restoring it, the class is absent from the CLI runtime classpath. 6. The CLI fails with an `ExceptionInInitializerError` during early bootstrap, before reaching `OMProxyInfo` or executing `buildTokenService`. ### Impact This blocks secure cluster configurations that rely on `ozone.client.failover.resolve-needed`. When security is enabled, that setting requires `hadoop.security.token.service.use_ip=false`. Under the default `use_ip=true`, delegation token service keys are bound to `IP:port`. When an OzoneManager's IP changes (e.g., following a DNS refresh), `OzoneDelegationTokenSelector` fails to select the existing token because the stored token key does not match the new IP service string. Setting `use_ip=false` keeps service keys as stable `hostname:port` identifiers, but currently causes any CLI command connecting to the cluster to crash. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-17726 ## How was this patch tested? Unit test @adoroszlai -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
