Kerberized hive with not-kerberized Zookeeper

Question

Hi.

I was wondering if anyone can confirm or deny that kerberized hive can (how?) work with not kerberized Zookeeper (+kerberized HDFS and Yarn).

Unless I overlooked something (which is very possible), it seems like in line 93 of attached log hive is trying to auth against ZK, and since there is any ZK security enabled this attempt failed.

If I'm right, is there any property that I can set up to disable auth attempts on hive side? hdfs/yarn seems to have zero problems working with unsecured ZK.

Or perhaps we need to enable kerberos on ZK nodes because hive won't work otherwise, period?

Czarniak · Accepted Answer

@asishThat was also my impression, but I was not able to find any solid confirmation. Eventually I kerberized ZK, correct bunch of playbooks to reflect that, and it works fine now.

asish · Answer

@Czarniak You can de-register Hiveserver2 from Zookeeper

https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.5/fault-tolerance/content/dynamic_service_discovery_through_zookeeper.html

Connect directly to hiveserver2 without zookeeper quorom.

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.