This is an automated email from the ASF dual-hosted git repository.
deardeng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 0443791f20b [fix](fe) Preserve Kerberos authentication in HDFS storage
vaults (#70320)
0443791f20b is described below
commit 0443791f20bf2478ab0f9178cb44f136e6298bc4
Author: deardeng <[email protected]>
AuthorDate: Tue Nov 10 11:02:05 2026 +0800
[fix](fe) Preserve Kerberos authentication in HDFS storage vaults (#70320)
CREATE and ALTER STORAGE VAULT serialize HDFS connection properties into
a vault request for Meta Service. The BE uses the persisted HDFS
configuration to select the authentication method.
Problem Summary:
A Kerberos HDFS vault created or updated through SQL can fail when the
BE opens remote files. The FE validates the credential properties but
drops the authentication mode, so the BE defaults to simple
authentication. Preserve the authentication mode in the existing HDFS
configuration entries.
### Details
- **Frequency:** SQL CREATE or ALTER of an HDFS storage vault with
Kerberos authentication.
- **Root cause:** The authentication property takes a validation-only
branch in the shared request serializer.
- **Why existing tests missed it:** Credential validation tests cover
invalid or missing credentials. The HDFS pipeline preconfigures its
Kerberos vault directly through Meta Service.
- **Fix:** Serialize the authentication key and value in the lowercase
form recognized by the BE, after the existing credential checks.
- **Other paths and branches:** Both CREATE and ALTER use the same
serializer. Existing affected vaults need an ALTER after upgrade to
persist the missing property.
---
.../java/org/apache/doris/catalog/HdfsStorageVault.java | 3 +++
.../apache/doris/cloud/catalog/HdfsStorageVaultTest.java | 15 +++++++++++++++
2 files changed, 18 insertions(+)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
b/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
index 62167919196..b4d31e52fd2 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
@@ -186,6 +186,9 @@ public class HdfsStorageVault extends StorageVault {
"%s is required for kerberos",
PropertyKey.HADOOP_KERBEROS_PRINCIPAL);
Preconditions.checkArgument(lowerCaseKeys.contains(PropertyKey.HADOOP_KERBEROS_KEYTAB),
"%s is required for kerberos",
PropertyKey.HADOOP_KERBEROS_KEYTAB);
+
hdfsConfBuilder.addHdfsConfs(Cloud.HdfsBuildConf.HdfsConfKVPair.newBuilder()
+ .setKey(PropertyKey.HADOOP_SECURITY_AUTHENTICATION)
+
.setValue(property.getValue().toLowerCase(Locale.ROOT)));
} else if
(property.getKey().equalsIgnoreCase(PropertyKey.HADOOP_KERBEROS_PRINCIPAL)) {
Preconditions.checkArgument(!Strings.isNullOrEmpty(property.getValue()),
"%s is null or empty", property.getKey());
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
b/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
index 03d292b7442..87580a7f091 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
@@ -65,6 +65,21 @@ public class HdfsStorageVaultTest {
return vault;
}
+ @Test
+ public void testGenerateHdfsParamPreservesKerberosAuthentication() {
+ String authKey =
HdfsStorageVault.PropertyKey.HADOOP_SECURITY_AUTHENTICATION;
+ Cloud.HdfsBuildConf buildConf =
HdfsStorageVault.generateHdfsParam(ImmutableMap.of(
+ authKey.toUpperCase(Locale.ROOT), "KERBEROS",
+ HdfsStorageVault.PropertyKey.HADOOP_KERBEROS_PRINCIPAL,
"hdfs/[email protected]",
+ HdfsStorageVault.PropertyKey.HADOOP_KERBEROS_KEYTAB,
"/etc/krb5.keytab")).getBuildConf();
+
+ Assertions.assertEquals("hdfs/[email protected]",
buildConf.getHdfsKerberosPrincipal());
+ Assertions.assertEquals("/etc/krb5.keytab",
buildConf.getHdfsKerberosKeytab());
+
Assertions.assertEquals(List.of(Cloud.HdfsBuildConf.HdfsConfKVPair.newBuilder()
+ .setKey(authKey)
+ .setValue("kerberos").build()), buildConf.getHdfsConfsList());
+ }
+
@Test
public void testAlterMetaServiceNormal() throws Exception {
MetaServiceProxy mockProxy = Mockito.mock(MetaServiceProxy.class);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
