CryoThrust commented on issue #12766: URL: https://github.com/apache/seatunnel/issues/12766#issuecomment-6182268200
I checked the official `2.3.13` source as well as current dev (`25bcc53f`), and there is a concrete configuration gap worth separating from the worker/environment checks above: - `HudiSinkOptions` / `HudiSinkFactory.optionRule()` do not declare `use.kerberos`, `kerberos.principal` or `kerberos.principal.file`, and `HudiSinkConfig.of()` does not read them. Supplying these keys therefore does not configure a connector-owned keytab login in this code path. - `HudiUtil.initKerberosAuthentication(...)` exists, but I found no callers in the Hudi connector in either revision. Its presence alone does not mean the writer establishes a login. - `createHoodieJavaWriteClient(...)` loads `conf_files_path` into the Hadoop configuration and constructs the Hudi client without invoking that helper. Loading the XML files supplies Hadoop settings; it does not perform the keytab login specified by those three sink options. Relevant 2.3.13 sources: [configuration parsing](https://github.com/apache/seatunnel/blob/8c9d47f5ea7e634d2d27952c7ee7a55269218950/seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/config/HudiSinkConfig.java), [helper and client construction](https://github.com/apache/seatunnel/blob/8c9d47f5ea7e634d2d27952c7ee7a55269218950/seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/util/HudiUtil.java). This is source-level evidence, not a reproduction against a Kerberos cluster; an externally established worker login or a patched connector could change the behavior. Along with the build details requested above, could you confirm whether your plugin is the official unmodified 2.3.13 JAR and whether the worker obtains a login outside the connector? If connector-owned keytab authentication is intended here, I can work on a patch. It should cover option parsing and identity propagation through catalog initialization, single-table and multi-table client creation, plus credential lifecycle. Calling the existing JVM-global login helper only around `executeWrite` would leave initialization and concurrent-job identity handling unresolved. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
