This is an automated email from the ASF dual-hosted git repository.
Gabriel39 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 4aab9c4a444 [fix](iceberg) Honor storage Kerberos settings and retain
REST credentials (#69598)
4aab9c4a444 is described below
commit 4aab9c4a444a8e4423adee5b2955d10d99bdc4b6
Author: Gabriel <[email protected]>
AuthorDate: Fri Oct 30 15:34:47 2026 +0800
[fix](iceberg) Honor storage Kerberos settings and retain REST credentials
(#69598)
### What problem does this PR solve?
Issue Number: N/A
Iceberg catalogs configured with `hdfs.authentication.*` can fail
against secured HDFS with `Client cannot authenticate via:[TOKEN,
KERBEROS]`. Storage binding already translates these properties into
Hadoop configuration, but plugin-side authenticator selection checks
only the raw legacy `hadoop.security.authentication` key and skips the
Kerberos identity.
Resolve authentication from the merged Hadoop configuration used by
FileIO and create a plugin authenticator only when it resolves to
Kerberos with a principal/keytab pair. XML resources can contain a
Kerberos mode without credentials; the shared resolver then falls back
to SIMPLE. Preserve the existing engine/storage authentication path in
that case so FileIO does not switch to the default `hadoop` user. Keep
HMS authentication separate.
Complete Kerberos credentials can also arrive through XML for a REST
catalog that vends temporary S3 credentials. Scan planning wraps the
table FileIO for authenticated manifest access, but that wrapper does
not expose Iceberg's optional `SupportsStorageCredentials` interface.
Iceberg 1.12 stores the REST response's `storage-credentials` separately
from `FileIO.properties()`, so inspecting the wrapper alone loses the
temporary keys forwarded to BE. Unwrap the authentication decorator only
while reading credential metadata; keep file operations authenticated
and preserve the existing optional capability surface. Add a
canonical-property unit test and an HMS/storage identity separation
check, and switch the existing Kerberos regression suite to canonical
storage properties so its read/write, rollback, and snapshot-expiration
coverage exercises this path.
### Release note
Iceberg catalogs honor canonical HDFS Kerberos authentication properties
for plugin-side file access and retain REST-vended storage credentials
when Kerberos is also enabled.
### Check List (For Author)
- Test
- [x] Unit Test: canonical credential selection and XML identity
fallback both have red/green verification; all 14 authenticator tests
pass, including incomplete principal/keytab pairs and the original
storage/HMS separation checks. Two additional tests use the real Iceberg
1.12 `S3FileIO` to cover XML-resolved Kerberos with separate REST
credentials, nested authentication decorators, credential refresh, the
disabled-vended gate, and BE access-key/secret-key/session-token
forwarding; both fail before the credential extraction fix and pass
afterward.
- [x] Unit Test: the complete Iceberg module reports 1743 tests, 0
failures, 0 errors, and 14 skipped (1729 passed), run through
`run-fe-ut.sh` with all 106 module test classes selected explicitly.
- [ ] Regression test: updated `test_iceberg_hadoop_catalog_kerberos`;
KDC/S3/HDFS end-to-end suites were not run locally.
- [x] FE Checkstyle: all 88 reactor modules pass `mvn -f fe/pom.xml
checkstyle:check`.
- Behavior changed:
- [x] Yes. Canonical HDFS Kerberos properties now select the plugin-side
storage authenticator.
- Does this need documentation?
- [x] No. This restores the existing properties' documented behavior.
---
.../iceberg/IcebergAuthenticatedFileIO.java | 5 ++
.../doris/connector/iceberg/IcebergConnector.java | 13 ++--
.../connector/iceberg/IcebergScanPlanProvider.java | 9 ++-
.../IcebergConnectorPluginAuthenticatorTest.java | 70 +++++++++++++++++
.../IcebergScanPlanProviderKerberosScanIoTest.java | 88 ++++++++++++++++++++++
.../test_iceberg_hadoop_catalog_kerberos.groovy | 6 +-
6 files changed, 179 insertions(+), 12 deletions(-)
diff --git
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergAuthenticatedFileIO.java
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergAuthenticatedFileIO.java
index c612f448a7c..c7fceb36fe1 100644
---
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergAuthenticatedFileIO.java
+++
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergAuthenticatedFileIO.java
@@ -111,6 +111,11 @@ class IcebergAuthenticatedFileIO implements FileIO {
return delegate.properties();
}
+ /** Exposes optional credential metadata; file operations must continue
through this decorator. */
+ FileIO delegate() {
+ return delegate;
+ }
+
@Override
public void initialize(Map<String, String> properties) {
delegate.initialize(properties);
diff --git
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java
index 3a9dd213dcf..5d3c3ef3095 100644
---
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java
+++
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java
@@ -166,9 +166,6 @@ public class IcebergConnector implements Connector {
// Entries whose meta.cache.iceberg.<entry>.max-weight this connector
reads.
static final String[] WEIGHTED_CACHE_ENTRIES = {"table", "partition",
"manifest", "partition_view"};
- // Doris storage property keys (mirror StorageProperties without a fe-core
dependency).
- // Catalog property key gating the plugin-side Kerberos authenticator
(value matches AuthType.KERBEROS).
- private static final String HADOOP_SECURITY_AUTHENTICATION =
"hadoop.security.authentication";
// Polaris REST catalog exposes its object-store base location under this
key when the
// "warehouse" property is a catalog name rather than an s3:// location.
private static final String REST_DEFAULT_BASE_LOCATION =
"default-base-location";
@@ -1444,9 +1441,13 @@ public class IcebergConnector implements Connector {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ // XML may enable Kerberos without credentials; its SIMPLE fallback
must retain the engine's storage identity.
+ AuthenticationConfig authConfig =
AuthenticationConfig.getKerberosConfig(conf);
+ if (authConfig instanceof KerberosAuthenticationConfig) {
+ return HadoopAuthenticator.getHadoopAuthenticator(authConfig);
}
return null;
}
diff --git
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergScanPlanProvider.java
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergScanPlanProvider.java
index 6b54862f7e2..10bf7c53023 100644
---
a/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergScanPlanProvider.java
+++
b/fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergScanPlanProvider.java
@@ -2119,6 +2119,10 @@ public class IcebergScanPlanProvider implements
ConnectorScanPlanProvider {
}
FileIO fileIO = table.io();
Map<String, String> ioProps = new HashMap<>(fileIO.properties());
+ // REST credentials live outside properties(). Authentication
decorators must not hide them from BE.
+ while (fileIO instanceof IcebergAuthenticatedFileIO) {
+ fileIO = ((IcebergAuthenticatedFileIO) fileIO).delegate();
+ }
if (fileIO instanceof SupportsStorageCredentials) {
for (StorageCredential storageCredential :
((SupportsStorageCredentials) fileIO).credentials()) {
ioProps.putAll(storageCredential.config());
@@ -3655,9 +3659,8 @@ public class IcebergScanPlanProvider implements
ConnectorScanPlanProvider {
* test_iceberg_hadoop_catalog_kerberos failed SASL reading snap-*.avro at
plan time).
*
* <p>Non-Kerberos catalogs ({@code getPluginAuthenticator() == null}) and
offline tests (plain context /
- * non-{@link BaseTable} fakes) pass through unchanged. Kerberos and REST
vended credentials are disjoint
- * (the authenticator is gated on
hadoop.security.authentication=kerberos), so
- * {@code extractVendedToken}'s {@code instanceof
SupportsStorageCredentials} probe never sees the wrapper.
+ * non-{@link BaseTable} fakes) pass through unchanged. REST catalogs can
also inherit Kerberos settings from
+ * XML; credential extraction reads through this decorator while file
operations stay authenticated.
* The system-table path deliberately does NOT use this wrap: its {@code
FileScanTask}s are Java-serialized
* to the BE JNI reader and the wrapper (authenticator-bearing) is not
serializable — it is covered by the
* thread-level wrap in {@link #planSystemTableScan} instead.
Package-private for unit testing.
diff --git
a/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergConnectorPluginAuthenticatorTest.java
b/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergConnectorPluginAuthenticatorTest.java
index 2915f6821e6..e5079d7c7a9 100644
---
a/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergConnectorPluginAuthenticatorTest.java
+++
b/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergConnectorPluginAuthenticatorTest.java
@@ -18,6 +18,7 @@
package org.apache.doris.connector.iceberg;
import org.apache.doris.kerberos.HadoopAuthenticator;
+import org.apache.doris.kerberos.HadoopKerberosAuthenticator;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;
@@ -25,8 +26,12 @@ import org.apache.iceberg.hive.CachedClientPool;
import org.apache.iceberg.hive.HiveCatalog;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.PrivilegedExceptionAction;
import java.util.HashMap;
import java.util.Map;
@@ -65,6 +70,71 @@ public class IcebergConnectorPluginAuthenticatorTest {
Assertions.assertNotNull(auth, "storage kerberos must yield a plugin
authenticator");
}
+ @Test
+ public void canonicalStorageKerberosBuildsPluginAuthenticator() {
+ HadoopAuthenticator auth = IcebergConnector.buildPluginAuthenticator(
+ props("iceberg.catalog.type", "hms",
+ "hdfs.authentication.type", "kerberos",
+ "hdfs.authentication.kerberos.principal",
"[email protected]",
+ "hdfs.authentication.kerberos.keytab",
"/etc/security/storage.keytab"),
+ props("hadoop.security.authentication", "kerberos",
+ "hadoop.kerberos.principal", "[email protected]",
+ "hadoop.kerberos.keytab",
"/etc/security/storage.keytab"));
+ Assertions.assertTrue(auth instanceof HadoopKerberosAuthenticator,
+ "Canonical storage configuration must select the plugin-side
Kerberos UGI");
+ }
+
+ @Test
+ public void xmlKerberosWithoutCredentialsPreservesStorageIdentity(@TempDir
Path tmp) throws Exception {
+ Path resource = tmp.resolve("core-site.xml");
+ Files.writeString(resource, "<configuration><property>"
+ +
"<name>hadoop.security.authentication</name><value>kerberos</value>"
+ + "</property></configuration>");
+ Configuration xml = new Configuration(false);
+ xml.addResource(new org.apache.hadoop.fs.Path(resource.toUri()));
+ Map<String, String> storageConfig = new HashMap<>();
+ xml.forEach(entry -> storageConfig.put(entry.getKey(),
entry.getValue()));
+ HadoopAuthenticator auth = IcebergConnector.buildPluginAuthenticator(
+ props("iceberg.catalog.type", "hadoop",
+ "hdfs.authentication.type", "simple",
+ "hadoop.config.resources", resource.toString()),
+ storageConfig);
+ RecordingConnectorContext delegate = new RecordingConnectorContext();
+ TcclPinningConnectorContext context = new TcclPinningConnectorContext(
+ delegate, getClass().getClassLoader(), () -> auth);
+
+ String user =
UserGroupInformation.createRemoteUser("storage-user").doAs(
+ (PrivilegedExceptionAction<String>) () ->
context.executeAuthenticated(
+ () ->
UserGroupInformation.getCurrentUser().getUserName()));
+
+ Assertions.assertEquals("storage-user", user,
+ "XML without a Kerberos login pair must preserve the existing
storage identity");
+ Assertions.assertNull(auth);
+ Assertions.assertEquals(1, delegate.authCount);
+ }
+
+ @Test
+ public void incompleteStorageKerberosCredentialsDoNotBuildAuthenticator() {
+ for (String credential : new String[] {"hadoop.kerberos.principal",
"hadoop.kerberos.keytab"}) {
+ HadoopAuthenticator auth =
IcebergConnector.buildPluginAuthenticator(
+ props("iceberg.catalog.type", "hadoop"),
+ props("hadoop.security.authentication", "kerberos",
credential, "unused"));
+ Assertions.assertNull(auth, "A single Kerberos credential must not
select a SIMPLE plugin identity");
+ }
+ }
+
+ @Test
+ public void kerberosHmsWithSimpleStorageDoesNotBuildStorageAuthenticator()
{
+ HadoopAuthenticator auth = IcebergConnector.buildPluginAuthenticator(
+ props("iceberg.catalog.type", "hms",
+ "hive.metastore.authentication.type", "kerberos",
+ "hive.metastore.client.principal",
"[email protected]",
+ "hive.metastore.client.keytab",
"/etc/security/metastore.keytab",
+ "hdfs.authentication.type", "simple"),
+ props("hadoop.security.authentication", "simple"));
+ Assertions.assertNull(auth, "HMS credentials must not select the
storage Kerberos identity");
+ }
+
/**
* THE CUT-1 GAP: a Kerberized HMS whose data storage is simple. Storage
auth is unset, so the storage
* gate is off; the connector must fall back to the HMS
client-principal/keytab facts and still build a
diff --git
a/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergScanPlanProviderKerberosScanIoTest.java
b/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergScanPlanProviderKerberosScanIoTest.java
index 7c89496823f..e3649b95454 100644
---
a/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergScanPlanProviderKerberosScanIoTest.java
+++
b/fe/fe-connector/fe-connector-iceberg/src/test/java/org/apache/doris/connector/iceberg/IcebergScanPlanProviderKerberosScanIoTest.java
@@ -20,7 +20,9 @@ package org.apache.doris.connector.iceberg;
import org.apache.doris.connector.spi.scan.ConnectorScanRange;
import org.apache.doris.connector.spi.scan.ConnectorScanRequest;
import org.apache.doris.kerberos.HadoopAuthenticator;
+import org.apache.doris.kerberos.HadoopKerberosAuthenticator;
+import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.iceberg.BaseTable;
import org.apache.iceberg.DataFiles;
@@ -28,18 +30,28 @@ import org.apache.iceberg.FileFormat;
import org.apache.iceberg.PartitionSpec;
import org.apache.iceberg.Schema;
import org.apache.iceberg.Table;
+import org.apache.iceberg.TableProperties;
+import org.apache.iceberg.aws.s3.S3FileIO;
import org.apache.iceberg.catalog.Namespace;
import org.apache.iceberg.catalog.TableIdentifier;
import org.apache.iceberg.inmemory.InMemoryCatalog;
+import org.apache.iceberg.io.FileIO;
+import org.apache.iceberg.io.StorageCredential;
import org.apache.iceberg.metrics.MetricsReporter;
import org.apache.iceberg.types.Types;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
import java.security.PrivilegedExceptionAction;
import java.util.Collections;
+import java.util.HashMap;
import java.util.List;
+import java.util.Map;
+import java.util.Optional;
/**
* Guards the Kerberos scan-planning seam (the FOURTH plugin-side UGI doAs
locus, after DDL /
@@ -85,6 +97,82 @@ public class IcebergScanPlanProviderKerberosScanIoTest {
return ops;
}
+ private static Table tableWithFileIO(FileIO io) {
+ InMemoryCatalog catalog = new InMemoryCatalog();
+ catalog.initialize("test", Collections.emptyMap());
+ catalog.createNamespace(Namespace.of("db1"));
+ BaseTable table = (BaseTable)
catalog.createTable(TableIdentifier.of("db1", "t1"),
+ SCHEMA, PartitionSpec.unpartitioned(),
+ Collections.singletonMap(TableProperties.DEFAULT_FILE_FORMAT,
"parquet"));
+ return new BaseTable(new
IcebergAuthenticatedTableOperations(table.operations(), io), table.name());
+ }
+
+ @Test
+ public void xmlKerberosScanKeepsRestStorageCredentials(@TempDir Path tmp)
throws Exception {
+ Path resource = tmp.resolve("core-site.xml");
+ Files.writeString(resource, "<configuration>"
+ +
"<property><name>hadoop.security.authentication</name><value>kerberos</value></property>"
+ +
"<property><name>hadoop.kerberos.principal</name><value>[email protected]</value></property>"
+ +
"<property><name>hadoop.kerberos.keytab</name><value>unused.keytab</value></property>"
+ + "</configuration>");
+ Configuration xml = new Configuration(false);
+ xml.addResource(new org.apache.hadoop.fs.Path(resource.toUri()));
+ Map<String, String> storageConfig = new HashMap<>();
+ xml.forEach(entry -> storageConfig.put(entry.getKey(),
entry.getValue()));
+ Map<String, String> props = Map.of("iceberg.catalog.type", "rest",
+ "iceberg.rest.vended-credentials-enabled", "true",
"hadoop.config.resources", resource.toString());
+ HadoopAuthenticator auth =
IcebergConnector.buildPluginAuthenticator(props, storageConfig);
+ Assertions.assertInstanceOf(HadoopKerberosAuthenticator.class, auth);
+
+ try (S3FileIO io = new S3FileIO()) {
+ io.initialize(Collections.emptyMap());
+ Map<String, String> credentials = Map.of("s3.access-key-id",
"temporary-ak",
+ "s3.secret-access-key", "temporary-sk",
"s3.session-token", "temporary-token");
+
io.setCredentials(Collections.singletonList(StorageCredential.create("s3://bucket",
credentials)));
+ Assertions.assertTrue(io.properties().isEmpty(), "REST credentials
live outside FileIO properties");
+ TcclPinningConnectorContext context = new
TcclPinningConnectorContext(
+ new RecordingConnectorContext(),
getClass().getClassLoader(), () -> auth);
+ Table table = tableWithFileIO(io);
+ IcebergScanPlanProvider provider = new IcebergScanPlanProvider(
+ IcebergCatalogProperties.of(props), opsReturning(table),
context);
+ Table wrapped =
provider.wrapTableForScan(provider.wrapTableForScan(table));
+
+ Assertions.assertEquals(credentials,
IcebergScanPlanProvider.extractVendedToken(wrapped, true));
+
Assertions.assertTrue(IcebergScanPlanProvider.extractVendedToken(wrapped,
false).isEmpty());
+ Map<String, String> refreshed = Map.of("s3.access-key-id",
"refreshed-ak",
+ "s3.secret-access-key", "refreshed-sk",
"s3.session-token", "refreshed-token");
+
io.setCredentials(Collections.singletonList(StorageCredential.create("s3://bucket",
refreshed)));
+ Assertions.assertEquals(refreshed,
IcebergScanPlanProvider.extractVendedToken(wrapped, true));
+ }
+ }
+
+ @Test
+ public void kerberosScanForwardsRestStorageCredentialsToBe() {
+ try (S3FileIO io = new S3FileIO()) {
+ io.initialize(Collections.emptyMap());
+
io.setCredentials(Collections.singletonList(StorageCredential.create("s3://bucket",
+ Map.of("s3.access-key-id", "temporary-ak",
"s3.secret-access-key", "temporary-sk",
+ "s3.session-token", "temporary-token"))));
+ Table table = tableWithFileIO(io);
+ RecordingAuthenticator auth = new RecordingAuthenticator();
+ RecordingConnectorContext delegate = new
RecordingConnectorContext();
+ delegate.vendedBeProps = Map.of("AWS_ACCESS_KEY", "temporary-ak",
"AWS_SECRET_KEY", "temporary-sk",
+ "AWS_TOKEN", "temporary-token");
+ TcclPinningConnectorContext context = new
TcclPinningConnectorContext(
+ delegate, getClass().getClassLoader(), () -> auth);
+ IcebergScanPlanProvider provider = new
IcebergScanPlanProvider(IcebergCatalogProperties.of(
+ Map.of("iceberg.catalog.type", "rest",
"iceberg.rest.vended-credentials-enabled", "true")),
+ opsReturning(table), context);
+
+ Map<String, String> props = provider.getScanNodeProperties(null,
+ new IcebergTableHandle("db1", "t1"),
Collections.emptyList(), Optional.empty());
+
+ Assertions.assertEquals("temporary-ak",
props.get("location.AWS_ACCESS_KEY"));
+ Assertions.assertEquals("temporary-sk",
props.get("location.AWS_SECRET_KEY"));
+ Assertions.assertEquals("temporary-token",
props.get("location.AWS_TOKEN"));
+ }
+ }
+
/** Counts plugin-side doAs invocations; runs the action inline (no real
UGI/KDC involved). */
private static final class RecordingAuthenticator implements
HadoopAuthenticator {
int doAsCount;
diff --git
a/regression-test/suites/external_table_p0/kerberos/test_iceberg_hadoop_catalog_kerberos.groovy
b/regression-test/suites/external_table_p0/kerberos/test_iceberg_hadoop_catalog_kerberos.groovy
index 77a0926a6ac..c49f911734e 100644
---
a/regression-test/suites/external_table_p0/kerberos/test_iceberg_hadoop_catalog_kerberos.groovy
+++
b/regression-test/suites/external_table_p0/kerberos/test_iceberg_hadoop_catalog_kerberos.groovy
@@ -34,15 +34,15 @@ suite("test_iceberg_hadoop_catalog_kerberos",
"p0,external") {
'type'='iceberg',
'iceberg.catalog.type' = 'hadoop',
'warehouse' = 'hdfs://${externalEnvIp}:8520/tmp/iceberg/catalog',
- "hadoop.security.authentication" = "kerberos",
+ "hdfs.authentication.type" = "kerberos",
"hadoop.security.auth_to_local" =
"RULE:[2:\$1@\$0](.*@LABS.TERADATA.COM)s/@.*//
RULE:[2:\$1@\$0](.*@OTHERLABS.TERADATA.COM)s/@.*//
RULE:[2:\$1@\$0](.*@OTHERREALM.COM)s/@.*//
DEFAULT",
- "hadoop.kerberos.principal" =
"hive/[email protected]",
+ "hdfs.authentication.kerberos.principal" =
"hive/[email protected]",
"hadoop.kerberos.min.seconds.before.relogin" = "5",
"hadoop.kerberos.keytab.login.autorenewal.enabled" = "false",
- "hadoop.kerberos.keytab" =
"${keytab_root_dir}/hive-presto-master.keytab",
+ "hdfs.authentication.kerberos.keytab" =
"${keytab_root_dir}/hive-presto-master.keytab",
"fs.defaultFS" = "hdfs://${externalEnvIp}:8520",
"dfs.namenode.kerberos.principal" =
"hdfs/[email protected]",
"dfs.client.use.datanode.hostname" = "true",
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
