pithecuse527 commented on code in PR #13455:
URL: https://github.com/apache/gravitino/pull/13455#discussion_r4218846314
##########
clients/filesystem-hadoop3/src/main/java/org/apache/gravitino/filesystem/hadoop/GravitinoVirtualFileSystem.java:
##########
@@ -301,6 +301,7 @@ public long getDefaultBlockSize(Path f) {
@Override
public Token<?>[] addDelegationTokens(String renewer, Credentials
credentials) {
+ operations.prepareDelegationTokens(workingDirectory);
Review Comment:
you're right.. because Hadoop caches one GVFS instance for every
`gvfs://fileset/...` so there will be another error due to caching wrong
delegation token.
so i've played around with a few different approaches, and here are a few
things.
- New GVFS config `fs.gravitino.delegationToken.filesets`. GVFS resolves
each listed fileset and collects a token for its cluster.
- `spark.kerberos.access.hadoopFileSystems=gvfs://fileset` stays the trigger
(just like indicating a traditional hadoop namenode address).
- Also, only tokens owned by the current user are returned, so a catalog's
service keytab is never shipped to executors.
### E2E Tests
| | Cluster | NameNode (e.g.) | GVFS path (e.g.) | Resolved location (e.g.) |
|---|---|---|---|---|
| **D** | `fs.defaultFS` cluster | `hdfs://default-namenode:8020` |
`gvfs://fileset/catalog_d/schema/fileset_d` |
`hdfs://default-namenode:8020/path/to/fileset_d` |
| **H1** | Another Kerberized HDFS cluster | `hdfs://cluster1-namenode:8020`
| `gvfs://fileset/catalog_h1/schema/fileset_h1` |
`hdfs://cluster1-namenode:8020/path/to/fileset_h1` |
| **H2** | Another Kerberized HDFS cluster | `hdfs://cluster2-namenode:8020`
| `gvfs://fileset/catalog_h2/schema/fileset_h2` |
`hdfs://cluster2-namenode:8020/path/to/fileset_h2` |
All runs set `spark.kerberos.access.hadoopFileSystems=gvfs://fileset`.
| Reads | `spark.hadoop.fs.gravitino.delegationToken.filesets` | Result |
|---|---|---|
| H1 | (not set) | H1 ❌ |
| H1 | H1 | H1 ✅ |
| H1, H2 | H1 | H2 ❌ (your comment) |
| H1, H2 | H1, H2 | H1 ✅ H2 ✅ |
**Existing usage,** without `spark.kerberos.access.hadoopFileSystems`, still
works and has no impact on existing users whose GVFS paths resolve to
`fs.defaultFS`.
| Reads | `spark.hadoop.fs.gravitino.delegationToken.filesets` | Result |
|---|---|---|
| D | (not set) | D ✅ |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
