risyomei opened a new issue, #4946: URL: https://github.com/apache/kyuubi/issues/4946
### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) ### Search before asking - [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues. ### Describe the bug https://github.com/apache/kyuubi/blob/34e79b419592a4dd2c2fa96983b352c348e3bcce/kyuubi-server/src/main/scala/org/apache/kyuubi/server/KyuubiServer.scala#L167C1-L170 When `kyuubi.backend.server.event.json.log.path` is set to a hdfs path, (e.g. hdfs://namespace/tmp/kyuubi/events), `initLoggerEventHandler` method will try to create the target directory on HDFS during the server start up. However, this will cause `org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]` because the kinit service is not yet initialized. How to reproduce: 1. set `kyuubi.backend.server.event.json.log.path` to a HDFS (secured by kerberos) path. 2. sudo -u kyuubi kdestroy (to make sure no kinit cache was created by a previous run, kyuubi is the username which you run your kyuubi server) 3. sudo -u bin/kyuubi start You should see `org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]` Workaround: You can manually kinit first. e.g (sudo -u kyuubi kinit -kt your.keytab kyuubi/hostname@realm; sudo -u kyuubi bin/kyuubi start) ### Affects Version(s) master ### Kyuubi Server Log Output ```logtalk 2023-06-09 19:49:50.791 main WARN org.apache.hadoop.ipc.Client: Exception encountered while connecting to the server org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS] at org.apache.hadoop.security.SaslRpcClient.selectSaslClient(SaslRpcClient.java:179) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:392) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:577) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection.access$2100(Client.java:363) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:800) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:796) ~[hadoop-client-api-3.3.5.jar:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_372] at javax.security.auth.Subject.doAs(Subject.java:422) ~[?:1.8.0_372] at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1899) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:796) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client$Connection.access$3800(Client.java:363) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client.getConnection(Client.java:1649) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client.call(Client.java:1474) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.Client.call(Client.java:1427) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.ProtobufRpcEngine2$Invoker.invoke(ProtobufRpcEngine2.java:258) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.ipc.ProtobufRpcEngine2$Invoker.invoke(ProtobufRpcEngine2.java:139) ~[hadoop-client-api-3.3.5.jar:?] at com.sun.proxy.$Proxy27.mkdirs(Unknown Source) ~[?:?] at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.mkdirs(ClientNamenodeProtocolTranslatorPB.java:675) ~[hadoop-client-api-3.3.5.jar:?] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_372] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_372] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_372] at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_372] at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:433) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:166) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:158) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:96) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:362) ~[hadoop-client-api-3.3.5.jar:?] at com.sun.proxy.$Proxy28.mkdirs(Unknown Source) ~[?:?] at org.apache.hadoop.hdfs.DFSClient.primitiveMkdir(DFSClient.java:2507) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.hdfs.DFSClient.mkdirs(DFSClient.java:2483) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.hdfs.DistributedFileSystem$27.doCall(DistributedFileSystem.java:1485) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.hdfs.DistributedFileSystem$27.doCall(DistributedFileSystem.java:1482) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.FileSystemLinkResolver.resolve(FileSystemLinkResolver.java:81) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.hdfs.DistributedFileSystem.mkdirsInternal(DistributedFileSystem.java:1499) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.hdfs.DistributedFileSystem.mkdirs(DistributedFileSystem.java:1474) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.FileSystem.mkdirs(FileSystem.java:2457) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.FilterFileSystem.mkdirs(FilterFileSystem.java:341) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.viewfs.ChRootedFileSystem.mkdirs(ChRootedFileSystem.java:284) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.viewfs.ViewFileSystem.mkdirs(ViewFileSystem.java:672) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.hadoop.fs.FileSystem.mkdirs(FileSystem.java:767) ~[hadoop-client-api-3.3.5.jar:?] at org.apache.kyuubi.events.handler.JsonLoggingEventHandler.initialize(JsonLoggingEventHandler.scala:116) ~[kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.handler.JsonLoggingEventHandler.<init>(JsonLoggingEventHandler.scala:57) ~[kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.handler.ServerJsonLoggingEventHandler.<init>(ServerJsonLoggingEventHandler.scala:29) ~[kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.ServerEventHandlerRegister$.createJsonEventHandler(ServerEventHandlerRegister.scala:37) ~[kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.EventHandlerRegister.loadEventHandler(EventHandlerRegister.scala:66) ~[kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.EventHandlerRegister.$anonfun$register$2(EventHandlerRegister.scala:37) ~[kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.EventHandlerRegister.$anonfun$register$2$adapted(EventHandlerRegister.scala:36) ~[kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62) [scala-library-2.12.17.jar:?] at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55) [scala-library-2.12.17.jar:?] at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49) [scala-library-2.12.17.jar:?] at org.apache.kyuubi.events.EventHandlerRegister.register(EventHandlerRegister.scala:36) [kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.EventHandlerRegister.registerEventLoggers(EventHandlerRegister.scala:30) [kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.EventHandlerRegister.registerEventLoggers$(EventHandlerRegister.scala:28) [kyuubi-events_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.events.ServerEventHandlerRegister$.registerEventLoggers(ServerEventHandlerRegister.scala:27) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.server.KyuubiServer.initLoggerEventHandler(KyuubiServer.scala:193) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.server.KyuubiServer.initialize(KyuubiServer.scala:167) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.server.KyuubiServer$.startServer(KyuubiServer.scala:59) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.server.KyuubiServer$.main(KyuubiServer.scala:99) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] at org.apache.kyuubi.server.KyuubiServer.main(KyuubiServer.scala) [kyuubi-server_2.12-1.8.0-SNAPSHOT.jar:1.8.0-SNAPSHOT] ``` ### Kyuubi Engine Log Output _No response_ ### Kyuubi Server Configurations _No response_ ### Kyuubi Engine Configurations _No response_ ### Additional context _No response_ ### Are you willing to submit PR? - [X] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix. - [ ] No. I cannot submit a PR at this time. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
