This is an automated email from the ASF dual-hosted git repository.
omalley pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/trunk by this push:
new 12fa38d HADOOP-18139: Allow configuration of zookeeper server
principal.
12fa38d is described below
commit 12fa38d546e2de84fb89bee60aea9345ad35b46a
Author: Owen O'Malley <[email protected]>
AuthorDate: Wed Feb 23 16:17:53 2022 -0800
HADOOP-18139: Allow configuration of zookeeper server principal.
Fixes #4024
Signed-off-by: Owen O'Malley <[email protected]>
---
.../apache/hadoop/fs/CommonConfigurationKeys.java | 2 ++
.../delegation/ZKDelegationTokenSecretManager.java | 5 ++++
.../hadoop/util/curator/ZKCuratorManager.java | 29 ++++++++++++++++++++++
3 files changed, 36 insertions(+)
diff --git
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeys.java
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeys.java
index 6949c67..db82498 100644
---
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeys.java
+++
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeys.java
@@ -399,6 +399,8 @@ public class CommonConfigurationKeys extends
CommonConfigurationKeysPublic {
public static final String ZK_ACL_DEFAULT = "world:anyone:rwcda";
/** Authentication for the ZooKeeper ensemble. */
public static final String ZK_AUTH = ZK_PREFIX + "auth";
+ /** Principal name for zookeeper servers. */
+ public static final String ZK_SERVER_PRINCIPAL = ZK_PREFIX +
"server.principal";
/** Address of the ZooKeeper ensemble. */
public static final String ZK_ADDRESS = ZK_PREFIX + "address";
diff --git
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java
index 5e5ea8c..4525656 100644
---
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java
+++
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/ZKDelegationTokenSecretManager.java
@@ -55,6 +55,7 @@ import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.security.token.delegation.web.DelegationTokenManager;
import static org.apache.hadoop.util.Time.now;
+import org.apache.hadoop.util.curator.ZKCuratorManager;
import org.apache.zookeeper.CreateMode;
import org.apache.zookeeper.KeeperException;
import org.apache.zookeeper.KeeperException.NoNodeException;
@@ -98,6 +99,8 @@ public abstract class
ZKDelegationTokenSecretManager<TokenIdent extends Abstract
+ "kerberos.keytab";
public static final String ZK_DTSM_ZK_KERBEROS_PRINCIPAL = ZK_CONF_PREFIX
+ "kerberos.principal";
+ public static final String ZK_DTSM_ZK_KERBEROS_SERVER_PRINCIPAL =
ZK_CONF_PREFIX
+ + "kerberos.server.principal";
public static final String ZK_DTSM_TOKEN_SEQNUM_BATCH_SIZE = ZK_CONF_PREFIX
+ "token.seqnum.batch.size";
public static final String ZK_DTSM_TOKEN_WATCHER_ENABLED = ZK_CONF_PREFIX
@@ -202,6 +205,8 @@ public abstract class
ZKDelegationTokenSecretManager<TokenIdent extends Abstract
builder =
CuratorFrameworkFactory
.builder()
+ .zookeeperFactory(new ZKCuratorManager.HadoopZookeeperFactory(
+ conf.get(ZK_DTSM_ZK_KERBEROS_SERVER_PRINCIPAL)))
.aclProvider(aclProvider)
.namespace(
conf.get(ZK_DTSM_ZNODE_WORKING_PATH,
diff --git
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java
index edb4eb6..ef9cec6 100644
---
a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java
+++
b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java
@@ -28,12 +28,16 @@ import org.apache.curator.framework.CuratorFramework;
import org.apache.curator.framework.CuratorFrameworkFactory;
import org.apache.curator.framework.api.transaction.CuratorOp;
import org.apache.curator.retry.RetryNTimes;
+import org.apache.curator.utils.ZookeeperFactory;
import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.CommonConfigurationKeys;
import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.util.ZKUtil;
import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
import org.apache.zookeeper.data.ACL;
import org.apache.zookeeper.data.Stat;
import org.slf4j.Logger;
@@ -148,6 +152,8 @@ public final class ZKCuratorManager {
CuratorFramework client = CuratorFrameworkFactory.builder()
.connectString(zkHostPort)
+ .zookeeperFactory(new HadoopZookeeperFactory(
+ conf.get(CommonConfigurationKeys.ZK_SERVER_PRINCIPAL)))
.sessionTimeoutMs(zkSessionTimeout)
.retryPolicy(retryPolicy)
.authorization(authInfos)
@@ -428,4 +434,27 @@ public final class ZKCuratorManager {
.forPath(path, data));
}
}
+
+ public static class HadoopZookeeperFactory implements ZookeeperFactory {
+ private final String zkPrincipal;
+
+ public HadoopZookeeperFactory(String zkPrincipal) {
+ this.zkPrincipal = zkPrincipal;
+ }
+
+ @Override
+ public ZooKeeper newZooKeeper(String connectString, int sessionTimeout,
+ Watcher watcher, boolean canBeReadOnly
+ ) throws Exception {
+ ZKClientConfig zkClientConfig = new ZKClientConfig();
+ if (zkPrincipal != null) {
+ LOG.info("Configuring zookeeper to use {} as the server principal",
+ zkPrincipal);
+ zkClientConfig.setProperty(ZKClientConfig.ZK_SASL_CLIENT_USERNAME,
+ zkPrincipal);
+ }
+ return new ZooKeeper(connectString, sessionTimeout, watcher,
+ canBeReadOnly, zkClientConfig);
+ }
+ }
}
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
