CDH 5.14.4 federation and sentry ACL sync issue

[#1]

the platform is : CDH 5.14.4

after setting federation, the hdfs entrypoint is: viewfs://cluster6/ , the back namenode entrypoint is : hdfs://nameservice/ and hdfs://nameservice2/

add new warehouse directory is  /user2/hive/warehouse and managed by nameservice2.

but i found the strange things is  if i create database using hdfs://nameservice2, sentry can sync ACL with hdfs, but if i used viewfs://cluster6/ , sentry can not sync ACL.

for example:

create database test location '/user2/hive/warehouse/test.db'    can not sync ACL

but create database test location 'hdfs://nameservice2/user2/hive/warehouse/test.db' is ok.

who knows why ?

[#2]

recently, i was starting to investigate this issue by  debug information, the root cause is sentry didn't add the path to sentry table when using viewfs://clusterX, but sentry did add the path when using hdfs://nameservice or hdfs://nameservice2

the debug information is below:

1. DEBUG org.apache.sentry.service.thrift.NotificationProcessor: HMS Path Update [OP : addPath, authzObj : jlwang18, path : hdfs://nameservice/user/hive/warehouse/jlwang18.db, notification event ID: 103361576]

2.DEBUG org.apache.sentry.service.thrift.NotificationProcessor: HMS Path Update [OP : addPath, authzObj : jlwang17, path : viewfs://cluster6/user/hive/warehouse/jlwang17.db] - nothing to add, notification event ID: 103361563]

but i still don't know why nothing to add when using viewfs://cluster6 . 

[#3 · Accepted solution]

sentry issue list :

Relative URI paths not supported by Sentry

i was going to read the document of sentry , and found this issue. relative URI paths not support . i am not sure, i think viewfs://cluster6 is relative URI, the real path is hdfs://nameservice or hdfs://nameservice2