This is an automated email from the ASF dual-hosted git repository. yiguolei pushed a commit to branch branch-4.2 in repository https://gitbox.apache.org/repos/asf/doris.git
commit ceecc8bee6d93e1e8574aa6a7d22c38c54b0c0ba Author: Dongyang Li <[email protected]> AuthorDate: Tue Oct 13 10:18:08 2026 +0800 [fix](regression) branch-4.1: Reuse pinned Kerberos dependencies without host build networking (#68954) ### What problem does this PR solve? Issue Number: None Related PR: #68440 Kerberos regression is blocked before cases execute: the fixture installs packages from mutable Debian Bullseye repositories that can return 404, and Compose Bake rejects its host build network without an explicit entitlement. Use the existing Hive 3.1.3/Kerberos image by immutable digest as a dependency layer, then COPY this branch's entrypoint and health scripts as before. Remove only the Compose build network setting; the remaining Dockerfile needs no network, while runtime host networking, generated keytabs, fixture data, and readiness checks stay unchanged. This preserves the branch's service scripts, including newer fixture initialization. The invalid-HMS-principal test also sets its client auth_to_local rule explicitly, so it reaches the intended GSS failure instead of failing early with KerberosName.NoMatchingRule; its invalid service principal and GSS assertion are unchanged. Base image: `doristhirdpartydocker/hive@sha256:b094fbc1a61c65116fbe2f0bca562687a10af418e7a0b2865f8d7b70cd8ad03e`, published by #68440's pinned build recipe from source `63e413b47aba101fe67a862dc13f9bc75d88652c`; linux/amd64, Hive 3.1.3, krb5 packages `1.18.3-6+deb11u8`. ### Release note None ### Check List (For Author) - Test: Manual test - Anonymous registry lookup verified the manifest digest, linux/amd64 configuration, and source revision label. - All three branch fixtures built successfully on a Linux worker with `docker build --network=none`; package versions and copied entrypoint/health hashes were verified. - `git diff --check` passed; independent review found no additional code defects. - Live branch-4.1 build [215913](http://172.20.48.17:8111/buildConfiguration/Doris_Doris_x64_branch41_External_Kerberos/215913) executed all four functional suites and exposed the missing mapping in the negative test (3 passed, 1 failed). After this one-line setup fix, [215914](http://172.20.48.17:8111/buildConfiguration/Doris_Doris_x64_branch41_External_Kerberos/215914) finished SUCCESS: all four functional suites and the final health check passed, ignored=0 and muted=0. Both runs use the same Compile 215780 ASAN binary/source 917b20be83878e98f94e3ebf7efccc80346e3e50, with fixture/test changes applied to the matching case archive. This is not a PR-head binary or restored default-pipeline coverage claim. - Behavior changed: Yes. Kerberos fixture builds no longer install APT packages or require host build networking. - Does this need documentation: No - Community External: [TeamCity build 1067492](http://43.132.222.7:8111/viewLog.html?buildId=1067492&buildTypeId=Doris_External_Regression) finished SUCCESS on PR head `e15debfb1acace03596574c9dd2078005e8e9ba3`; 705 passed, failed=0, ignored=0, muted=4. The four Kerberos suites (`test_iceberg_hadoop_catalog_kerberos`, `test_non_catalog_kerberos`, `test_single_hive_kerberos`, `test_two_hive_kerberos`) all executed and succeeded; TeamCity reports no build problems. --- docker/thirdparties/docker-compose/kerberos/Dockerfile | 11 +++-------- docker/thirdparties/docker-compose/kerberos/kerberos.yaml.tpl | 1 - .../kerberos/test_single_hive_kerberos.groovy | 1 + 3 files changed, 4 insertions(+), 9 deletions(-) diff --git a/docker/thirdparties/docker-compose/kerberos/Dockerfile b/docker/thirdparties/docker-compose/kerberos/Dockerfile index 88723e1313b..fe52abf2fd6 100644 --- a/docker/thirdparties/docker-compose/kerberos/Dockerfile +++ b/docker/thirdparties/docker-compose/kerberos/Dockerfile @@ -15,17 +15,12 @@ # specific language governing permissions and limitations # under the License. -FROM apache/hive:3.1.3 +# Hive 3.1.3 with krb5 1.18.3-6+deb11u8, built from the pinned recipe in #68440. +# Keep this branch's entrypoint and health checks in the small layer below. +FROM doristhirdpartydocker/hive@sha256:b094fbc1a61c65116fbe2f0bca562687a10af418e7a0b2865f8d7b70cd8ad03e USER root -RUN apt-get -o Acquire::Retries=3 -o APT::Update::Error-Mode=any update \ - && DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \ - krb5-admin-server \ - krb5-kdc \ - krb5-user \ - && rm -rf /var/lib/apt/lists/* - COPY entrypoint-hive-master.sh /opt/doris/entrypoint.sh COPY health-checks/health.sh /opt/doris/health.sh diff --git a/docker/thirdparties/docker-compose/kerberos/kerberos.yaml.tpl b/docker/thirdparties/docker-compose/kerberos/kerberos.yaml.tpl index 8e903ed6d7f..cf1dc94867c 100644 --- a/docker/thirdparties/docker-compose/kerberos/kerberos.yaml.tpl +++ b/docker/thirdparties/docker-compose/kerberos/kerberos.yaml.tpl @@ -20,7 +20,6 @@ x-kerberos-image: &kerberos-image build: context: . dockerfile: Dockerfile - network: host x-kerberos-service: &kerberos-service <<: *kerberos-image diff --git a/regression-test/suites/external_table_p0/kerberos/test_single_hive_kerberos.groovy b/regression-test/suites/external_table_p0/kerberos/test_single_hive_kerberos.groovy index 9b9b5af37ae..bd999b9ebec 100644 --- a/regression-test/suites/external_table_p0/kerberos/test_single_hive_kerberos.groovy +++ b/regression-test/suites/external_table_p0/kerberos/test_single_hive_kerberos.groovy @@ -108,6 +108,7 @@ suite("test_single_hive_kerberos", "p0,external,kerberos,external_docker,externa "hadoop.security.authentication" = "kerberos", "hadoop.kerberos.principal"="presto-server/[email protected]", "hadoop.kerberos.keytab" = "${keytab_root_dir}/presto-server.keytab", + "hadoop.security.auth_to_local" = "RULE:[2:\$1@\$0](.*@LABS.TERADATA.COM)s/@.*// DEFAULT", "hive.metastore.kerberos.principal" = "hive/[email protected]" ); """ --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
