> On March 8, 2016, 8:39 a.m., Robert Levas wrote:
> > ambari-common/src/main/python/resource_management/libraries/functions/curl_krb_request.py,
> >  line 63
> > <https://reviews.apache.org/r/44472/diff/1/?file=1283499#file1283499line63>
> >
> >     It seems like `kinit_timer_ms` would be global setting rather than a 
> > passed in value.
> 
> Jonathan Hurley wrote:
>     Yeah, me too! But the problem is that this module is "common" code; it 
> doesn't have access to any configurations, like AmbariConfig, that the agent 
> does. So where would this property be stored?

Thought that this was the reasoning... that is why I didn't make it an issue... 
it was just a comment. :)


- Robert


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/44472/#review122510
-----------------------------------------------------------


On March 8, 2016, 9:43 a.m., Jonathan Hurley wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/44472/
> -----------------------------------------------------------
> 
> (Updated March 8, 2016, 9:43 a.m.)
> 
> 
> Review request for Ambari, Alejandro Fernandez and Robert Levas.
> 
> 
> Bugs: AMBARI-15324
>     https://issues.apache.org/jira/browse/AMBARI-15324
> 
> 
> Repository: ambari
> 
> 
> Description
> -------
> 
> When a cluster has been Kerberized, alerts use the {{curl_krb_request}} 
> module in order to make requests using SPNEGO negotiation.
> 
> Normally this would involve calling {{kinit}} and then invoking the {{curl}} 
> command to use the acquired ticket. However, because alerts run often on 
> fixed intervals, this would mean that the KDC would be flooded with requests 
> every minute.
> 
> To alleviate this problem, {{curl_krb_request}} uses {{klist}} to inspect the 
> {{KRB5CCNAME}} cache. Only if an invalid ticket is found is {{kinit}} 
> invoked. Additionally, {{kinit}} is invoked with a fixed ticket lifetime of 5 
> minutes. Since many alerts run on 5-minute intervals, this causes boundary 
> issues.
> 
> To workaround these problems while continuing to leverage the cache, 
> {{curl_krb_request}} should be changed to:
> - Use the default ticket expiry configured for Kerberos in {{krb5.conf}}
> - Employ in-memory tracking of the last time {{kinit}} was called so that it 
> can be invoked before hitting the boundary of the ticket's expiration time
> 
> 
> Diffs
> -----
> 
>   
> ambari-common/src/main/python/resource_management/libraries/functions/curl_krb_request.py
>  1ccc45f 
> 
> Diff: https://reviews.apache.org/r/44472/diff/
> 
> 
> Testing
> -------
> 
> Deployed changes to a cluster with frequent 401's and "Cannot decode JSON" 
> messages. 
> 
> ----------------------------------------------------------------------
> Total run:924
> Total errors:0
> Total failures:0
> OK
> 
> 
> Thanks,
> 
> Jonathan Hurley
> 
>

Reply via email to