Hello @Softwarebyt,  Based on the error posted for @ipson, looks like this matches two NiFi Jiras:  https://issues.apache.org/jira/browse/NIFI-13720 https://issues.apache.org/jira/browse/NIFI-13722  Those fixes get included on CFM 2.1.7.1000: https://docs.cloudera.com/cfm/2.1.7/release-notes/topics/cfm-fixed-issues.html  And CDF for DataHub 7.3.1.0: https://docs.cloudera.com/cdf-datahub/7.3.1/release-notes/topics/cdf-datahub-fixed-issues-flow-management.html  ... View more

Hello @ksw,  Sorry, just checking more looks like it was to solve an UI bug. Not an specific CVE.  For CVE-2025-66035 / GHSA-58c5-g7wp-6w37 I suggest to open a ticket so we can report this with the security team.  Can you do that please?  If you have a CVE scanner and can run a report would be even better.  ... View more

Hello @intersoldi,  Thanks for reaching our community. Glad to have you here.  The error looks clear on this message:  2024-07-11T07:30:57,262 WARN com.snowflake.kafka.connector.internal.SnowflakeInternalStage: [kafka_snowflake_poc_2|task-0] [SF_KAFKA_CONNECTOR] uploadWithoutConnection encountered an exception:JDBC driver encountered IO error. Message: Encountered exception during upload: null. for filePath:kafka_snowflake_poc_2/existing_table1/0/1_1_1720683056775.json.gz in Storage:AZURE 2024-07-11T07:30:57,265 ERROR com.snowflake.kafka.connector.internal.InternalUtils: [kafka_snowflake_poc_2|task-0] [SF_KAFKA_CONNECTOR] Retry count:0 caught an exception for operation:UPLOAD_FILE_TO_INTERNAL_STAGE_NO_CONNECTION with message:[SF_KAFKA_CONNECTOR] Exception: Failed to execute cached put Error Code: 5018 Detail: Error in cached put command Message: JDBC driver encountered IO error. Message: Encountered exception during upload: null. Kafka on CDP have access to the Snowflake domain, but the put on Azure storage is failing.  Most likely there is a proxy or firewall that is not helping on this connection.  You can test with this command:  curl -v https://azure_name.blob.core.windows.net  If you have a proxy, try to add it to the KAFKA_OPTS with these options -Dhttps.proxyHost=<proxy_host> -Dhttps.proxyPort=<proxy_port>   Also, if you change the connector to Snowpipe Streaming method, that upload can be avoided and possible this issue gets solved.  To do that you can update the JSON for the connector with this setting:  "snowflake.ingestion.method": "SNOWPIPE_STREAMING"    Check those points and see if it helps.  ... View more

@DevOpsWorld Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.  Thanks. ... View more

@kiki_adm, Did this response help resolve your query? If so, please consider marking the relevant reply as the accepted solution. This helps other community members find answers more easily in the future. ... View more

I think this is wrong, but maybe I'm being dumb or missing something obvious here: "certs only need to have the SANs matching what the nodes uses to talk each other." I DO need public DNS names if I don't want users to see cert errors though right? The certs don't _only_ need to match the node names they need to be issued from a trusted CA which requires the nodes to have public DNS names. This is the main issue. I can easily automate issuing self-signed certs for node communication (without having to deploy a whole PKI, DNS, letsencrypt, etc) BUT because NIFI uses the same channel for APIs users will see cert errors and I wont be able to terminate SSL at the LB Perhaps there is a way to issue self-signed certs AND terminate SSL at the LB with a different public cert and then maybe do some kind of redirect? Ultimately users would still be redirected to the URL with the self-signed cert and see errors though I think? I think the only way to do this is... Drop SSL everywhere (but how ?) I've been trying to just drop all security to make it all HTTP so I can terminate SSL at the LB, but this is really poorly documented and I haven't been able to actually get it to do everything HTTP. NIFI has so many of its internals super tightly coupled to HTTPS and there are so many individual configuration fields related to this. Is there any known working config to just set it to HTTP everywhere? I have it running on k8s and I can use security features of the cluster to lock it down instead. Hell I even gave it its own cluster so its even more isolated, I definitely don't need HTTPS for intra-node communication. ... View more

Spark lazily evaluates the workload. The actual execution happens when you write the output, usually. If it gets stuck there that means the workload is not tuned with respect to your infrastructure. Try checking the logs, most likely you need to tune your shuffle partition and/or repartition your data.🙂 ... View more