question Re: Kerberized hive with not-kerberized Zookeeper in Support Questions

Kerberized hive with not-kerberized Zookeeper

Czarniak — Fri, 21 Jan 2022 08:57:25 GMT

Hi.

I was wondering if anyone can confirm or deny that kerberized hive can (how?) work with not kerberized Zookeeper (+kerberized HDFS and Yarn).

Unless I overlooked something (which is very possible), it seems like in line 93 of attached log hive is trying to auth against ZK, and since there is any ZK security enabled this attempt failed.

If I'm right, is there any property that I can set up to disable auth attempts on hive side? hdfs/yarn seems to have zero problems working with unsecured ZK.

Or perhaps we need to enable kerberos on ZK nodes because hive won't work otherwise, period?

Re: Kerberized hive with not-kerberized Zookeeper

asish — Fri, 21 Jan 2022 12:13:15 GMT

@Czarniak You can de-register Hiveserver2 from Zookeeper

https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.5/fault-tolerance/content/dynamic_service_discovery_through_zookeeper.html

Connect directly to hiveserver2 without zookeeper quorom.

Re: Kerberized hive with not-kerberized Zookeeper

Czarniak — Fri, 21 Jan 2022 15:22:20 GMT

That might be a good idea with only single hiveserver, we will have like 7 of them 🙂

That is why I'm asking if the current setup is even possible. If not, kerberizing ZK will get much higher priority. Which is a good thing I guess...

Re: Kerberized hive with not-kerberized Zookeeper

asish — Wed, 02 Feb 2022 08:46:01 GMT

@Czarniak The current setup is not possible

Re: Kerberized hive with not-kerberized Zookeeper

Czarniak — Wed, 02 Feb 2022 12:26:08 GMT

@asishThat was also my impression, but I was not able to find any solid confirmation. Eventually I kerberized ZK, correct bunch of playbooks to reflect that, and it works fine now.