[
https://issues.apache.org/jira/browse/NIFI-13496?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17863215#comment-17863215
]
ASF subversion and git services commented on NIFI-13496:
--------------------------------------------------------
Commit f57a96dbfbf739b53d1bdb6434f40e84a6528883 in nifi's branch
refs/heads/main from Peter Turcsanyi
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=f57a96dbfb ]
NIFI-13496 Included Hadoop configuration file paths in the classloader
isolation key of HDFS processors
Signed-off-by: Mark Bathori <[email protected]>
This closes #9038
> HDFS processors' classloader isolation key should include Hadoop
> configuration files
> ------------------------------------------------------------------------------------
>
> Key: NIFI-13496
> URL: https://issues.apache.org/jira/browse/NIFI-13496
> Project: Apache NiFi
> Issue Type: Bug
> Reporter: Peter Turcsanyi
> Assignee: Peter Turcsanyi
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The HDFS processors implement {{ClassloaderIsolationKeyProvider}} in order to
> leverage shared parent classloading (NIFI-9382). The current implementation
> considers the Kerberos principal name only as an isolation factor.
> However, Hadoop xml configuration resources may also contain parameters that
> can lead to initialization of static / singleton resources in the Hadoop
> client. E.g. when KMS is used and is accessed via HTTPS, then [SSLFactory in
> KMSClientProvider|https://github.com/apache/hadoop/blob/c33d86860606f972f8b743b02f629b14f83d14f2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/kms/KMSClientProvider.java#L389]
> is initialized only once and globally for all components. Therefore, it is
> not possible to use different SSL settings or SSL + no-SSL in different
> components in parallel if a shared classloader is used.
> The SSL for the Hadoop client in NiFi is configured by specifying the path of
> {{ssl-client.xml}} in Additional Classpath Resources property of the HDFS
> processors.
> In order to provide proper classloader isolation, add the value of Additional
> Classpath Resources property to the isolation key. Also add Hadoop
> Configuration Resources property because it may contain configurations with
> similar effect too.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
