> On March 8, 2016, 8:39 a.m., Robert Levas wrote: > > ambari-common/src/main/python/resource_management/libraries/functions/curl_krb_request.py, > > line 63 > > <https://reviews.apache.org/r/44472/diff/1/?file=1283499#file1283499line63> > > > > It seems like `kinit_timer_ms` would be global setting rather than a > > passed in value. > > Jonathan Hurley wrote: > Yeah, me too! But the problem is that this module is "common" code; it > doesn't have access to any configurations, like AmbariConfig, that the agent > does. So where would this property be stored?
Thought that this was the reasoning... that is why I didn't make it an issue... it was just a comment. :) - Robert ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/44472/#review122510 ----------------------------------------------------------- On March 8, 2016, 9:43 a.m., Jonathan Hurley wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/44472/ > ----------------------------------------------------------- > > (Updated March 8, 2016, 9:43 a.m.) > > > Review request for Ambari, Alejandro Fernandez and Robert Levas. > > > Bugs: AMBARI-15324 > https://issues.apache.org/jira/browse/AMBARI-15324 > > > Repository: ambari > > > Description > ------- > > When a cluster has been Kerberized, alerts use the {{curl_krb_request}} > module in order to make requests using SPNEGO negotiation. > > Normally this would involve calling {{kinit}} and then invoking the {{curl}} > command to use the acquired ticket. However, because alerts run often on > fixed intervals, this would mean that the KDC would be flooded with requests > every minute. > > To alleviate this problem, {{curl_krb_request}} uses {{klist}} to inspect the > {{KRB5CCNAME}} cache. Only if an invalid ticket is found is {{kinit}} > invoked. Additionally, {{kinit}} is invoked with a fixed ticket lifetime of 5 > minutes. Since many alerts run on 5-minute intervals, this causes boundary > issues. > > To workaround these problems while continuing to leverage the cache, > {{curl_krb_request}} should be changed to: > - Use the default ticket expiry configured for Kerberos in {{krb5.conf}} > - Employ in-memory tracking of the last time {{kinit}} was called so that it > can be invoked before hitting the boundary of the ticket's expiration time > > > Diffs > ----- > > > ambari-common/src/main/python/resource_management/libraries/functions/curl_krb_request.py > 1ccc45f > > Diff: https://reviews.apache.org/r/44472/diff/ > > > Testing > ------- > > Deployed changes to a cluster with frequent 401's and "Cannot decode JSON" > messages. > > ---------------------------------------------------------------------- > Total run:924 > Total errors:0 > Total failures:0 > OK > > > Thanks, > > Jonathan Hurley > >
