question Re: CDH 5.14.4 federation and sentry ACL sync issue in Support Questions

CDH 5.14.4 federation and sentry ACL sync issue

iamfromsky — Wed, 17 Jan 2024 09:35:51 GMT

the platform is : CDH 5.14.4

after setting federation, the hdfs entrypoint is: viewfs://cluster6/ , the back namenode entrypoint is : hdfs://nameservice/ and hdfs://nameservice2/

add new warehouse directory is /user2/hive/warehouse and managed by nameservice2.

but i found the strange things is if i create database using hdfs://nameservice2, sentry can sync ACL with hdfs, but if i used viewfs://cluster6/ , sentry can not sync ACL.

for example:

create database test location '/user2/hive/warehouse/test.db' can not sync ACL

but create database test location 'hdfs://nameservice2/user2/hive/warehouse/test.db' is ok.

who knows why ?

Re: CDH 5.14.4 federation and sentry ACL sync issue

iamfromsky — Thu, 25 Jan 2024 06:23:58 GMT

recently, i was starting to investigate this issue by debug information, the root cause is sentry didn't add the path to sentry table when using viewfs://clusterX, but sentry did add the path when using hdfs://nameservice or hdfs://nameservice2

the debug information is below:

1. DEBUG org.apache.sentry.service.thrift.NotificationProcessor: HMS Path Update [OP : addPath, authzObj : jlwang18, path : hdfs://nameservice/user/hive/warehouse/jlwang18.db, notification event ID: 103361576]

2.DEBUG org.apache.sentry.service.thrift.NotificationProcessor: HMS Path Update [OP : addPath, authzObj : jlwang17, path : viewfs://cluster6/user/hive/warehouse/jlwang17.db] - nothing to add, notification event ID: 103361563]

but i still don't know why nothing to add when using viewfs://cluster6 .

Re: CDH 5.14.4 federation and sentry ACL sync issue

iamfromsky — Thu, 25 Jan 2024 06:45:07 GMT

sentry issue list :

Relative URI paths not supported by Sentry

i was going to read the document of sentry , and found this issue. relative URI paths not support . i am not sure, i think viewfs://cluster6 is relative URI, the real path is hdfs://nameservice or hdfs://nameservice2