Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

What is correct strategy for hbase Kerberos Login For Long running applications?

avatar
Explorer

We run hbase client in long running application in kerberized cluster.

We login to hadoop and hbase using UserGroupInformation class.

Also, we launch as background thread to relogin.

However , this code does not work with versions of hbase-client ( 0.98-4-hadoop2 and hadoop-common 2.6.0).

Is there a better way to perform kerberos login usinf keytab and taking care of ticket expiry.

1 ACCEPTED SOLUTION

avatar

Arvind, you may be using a combination of Hadoop & JDK that doesn't support keytab renewal. The later versions of Hadoop 2.6 (that's apache 2.6.2+ and HDP 2.2 maintenance releases) should work.

View solution in original post

6 REPLIES 6

avatar
Super Guru

@Arvind K Jajoo This code looks reasonable. Can you please elaborate what does not work with 0.98.4?

avatar
Explorer

After every 30 minutes when thread enters into checkTGTAndReloginFromKeytab method it must relogin after 8 hours since our kerberos expiry is 10 hours but it does not relogin.

avatar

What version of Java are you using? I ask as some changes in Java 1.7 stopped ticket renewal in Hadoop 2.6.0/HDP2.2.0; it's been fixed in later Hadoop releases (2.6.2?) and later versions of HDP2.2+

avatar
Explorer

Ohh, we are using Java 1.7 and Hadoop 2.6 release .

avatar

Arvind, you may be using a combination of Hadoop & JDK that doesn't support keytab renewal. The later versions of Hadoop 2.6 (that's apache 2.6.2+ and HDP 2.2 maintenance releases) should work.

avatar

BTW, if you try that login & renew at startup, you should be able to fail fast and not wait so long to find out things aren't working.