This is an automated email from the ASF dual-hosted git repository.
mrhhsg pushed a commit to branch 4.0.8-safaricom
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/4.0.8-safaricom by this push:
new 32ceb09dee4 [fix](fe) Preserve Kerberos authentication in HDFS storage
vaults (#70320)
32ceb09dee4 is described below
commit 32ceb09dee412fc589fdc85a73f87b8e403318cf
Author: deardeng <[email protected]>
AuthorDate: Tue Nov 10 11:02:05 2026 +0800
[fix](fe) Preserve Kerberos authentication in HDFS storage vaults (#70320)
CREATE and ALTER STORAGE VAULT serialize HDFS connection properties into
a vault request for Meta Service. The BE uses the persisted HDFS
configuration to select the authentication method.
Problem Summary:
A Kerberos HDFS vault created or updated through SQL can fail when the
BE opens remote files. The FE validates the credential properties but
drops the authentication mode, so the BE defaults to simple
authentication. Preserve the authentication mode in the existing HDFS
configuration entries.
### Details
- **Frequency:** SQL CREATE or ALTER of an HDFS storage vault with
Kerberos authentication.
- **Root cause:** The authentication property takes a validation-only
branch in the shared request serializer.
- **Why existing tests missed it:** Credential validation tests cover
invalid or missing credentials. The HDFS pipeline preconfigures its
Kerberos vault directly through Meta Service.
- **Fix:** Serialize the authentication key and value in the lowercase
form recognized by the BE, after the existing credential checks.
- **Other paths and branches:** Both CREATE and ALTER use the same
serializer. Existing affected vaults need an ALTER after upgrade to
persist the missing property.
---
.../java/org/apache/doris/catalog/HdfsStorageVault.java | 3 +++
.../apache/doris/cloud/catalog/HdfsStorageVaultTest.java | 15 +++++++++++++++
2 files changed, 18 insertions(+)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
b/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
index c41d4540716..a96c3614194 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/catalog/HdfsStorageVault.java
@@ -189,6 +189,9 @@ public class HdfsStorageVault extends StorageVault {
"%s is required for kerberos",
PropertyKey.HADOOP_KERBEROS_PRINCIPAL);
Preconditions.checkArgument(lowerCaseKeys.contains(PropertyKey.HADOOP_KERBEROS_KEYTAB),
"%s is required for kerberos",
PropertyKey.HADOOP_KERBEROS_KEYTAB);
+
hdfsConfBuilder.addHdfsConfs(Cloud.HdfsBuildConf.HdfsConfKVPair.newBuilder()
+ .setKey(PropertyKey.HADOOP_SECURITY_AUTHENTICATION)
+
.setValue(property.getValue().toLowerCase(Locale.ROOT)));
} else if
(property.getKey().equalsIgnoreCase(PropertyKey.HADOOP_KERBEROS_PRINCIPAL)) {
Preconditions.checkArgument(!Strings.isNullOrEmpty(property.getValue()),
"%s is null or empty", property.getKey());
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
b/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
index 231858830bc..9b226f05575 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/cloud/catalog/HdfsStorageVaultTest.java
@@ -65,6 +65,21 @@ public class HdfsStorageVaultTest {
return vault;
}
+ @Test
+ public void testGenerateHdfsParamPreservesKerberosAuthentication() {
+ String authKey =
HdfsStorageVault.PropertyKey.HADOOP_SECURITY_AUTHENTICATION;
+ Cloud.HdfsBuildConf buildConf =
HdfsStorageVault.generateHdfsParam(ImmutableMap.of(
+ authKey.toUpperCase(Locale.ROOT), "KERBEROS",
+ HdfsStorageVault.PropertyKey.HADOOP_KERBEROS_PRINCIPAL,
"hdfs/[email protected]",
+ HdfsStorageVault.PropertyKey.HADOOP_KERBEROS_KEYTAB,
"/etc/krb5.keytab")).getBuildConf();
+
+ Assertions.assertEquals("hdfs/[email protected]",
buildConf.getHdfsKerberosPrincipal());
+ Assertions.assertEquals("/etc/krb5.keytab",
buildConf.getHdfsKerberosKeytab());
+
Assertions.assertEquals(List.of(Cloud.HdfsBuildConf.HdfsConfKVPair.newBuilder()
+ .setKey(authKey)
+ .setValue("kerberos").build()), buildConf.getHdfsConfsList());
+ }
+
@Test
public void testAlterMetaServiceNormal() throws Exception {
new MockUp<MetaServiceProxy>(MetaServiceProxy.class) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
