Steven Rand created SPARK-22319:
-----------------------------------
Summary: SparkSubmit calls getFileStatus before calling
loginUserFromKeytab
Key: SPARK-22319
URL: https://issues.apache.org/jira/browse/SPARK-22319
Project: Spark
Issue Type: Bug
Components: Deploy, Spark Core
Affects Versions: 2.3.0
Reporter: Steven Rand
In the SparkSubmit code, we call {{resolveGlobPaths}}, which eventually calls
{{getFileStatus}}, which for HDFS is an RPC call to the NameNode:
https://github.com/apache/spark/blob/master/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala#L346.
We do this before we call {{loginUserFromKeytab}}, which is further down in the
same method:
https://github.com/apache/spark/blob/master/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala#L655.
The result is that the call to {{resolveGlobPaths}} fails in secure clusters
with:
{code}
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException:
No valid credentials provided (Mechanism level: Failed to find any Kerberos
tgt)]
{code}
A workaround is to {{kinit}} on the host before using spark-submit. However,
it's better if this workaround isn't necessary. A simple fix is to call
loginUserFromKeytab before attempting to interact with HDFS.
At least for cluster mode, this would appear to be a regression caused by
SPARK-21012.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@spark.apache.org
For additional commands, e-mail: issues-h...@spark.apache.org
