Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/5820
to look at the new patch set (#8).
Change subject: KUDU-1845: Kerberos client keytab should be periodically renewed
......................................................................
KUDU-1845: Kerberos client keytab should be periodically renewed
With the current kerberos support, if a ticket expires, all
communication on a secure cluster would stop as we do not attempt
to renew the ticket.
This patch adds a renewal thread which periodically wakes up and
either renews the Ticket Granting Ticket or acquires a new one if
the renewal window is closed. The renew interval is controlled by
a newly introduced flag called 'kerberos_reinit_interval'.
A reader-writer lock is used to avoid a race at the time of ticket
reinitializtaion, which can occur between the time the credential
cache is reinitialized and the time the new credentials are placed
in the cache. The reader lock is taken before any call to the
SASL library (if kerberos is enabled) and the writer lock is
taken before reinitializing the cache and placing the new creds
in it.
Testing: Added 2 tests, one for ticket renewal and one for ticket
reacquisition. I haven't added tests to confirm if disabling the
renew thread makes these tests fail as that would require quite
some plumbing which I think is unnecessary. Instead, I manually
tested that disabling the renew thread causes the tests to fail.
Change-Id: Ic4c072c1210216369e60eac88be4a20d9b166b2d
---
M src/kudu/integration-tests/external_mini_cluster-test.cc
M src/kudu/integration-tests/external_mini_cluster.cc
M src/kudu/integration-tests/external_mini_cluster.h
M src/kudu/rpc/sasl_common.cc
M src/kudu/security/init.cc
M src/kudu/security/init.h
M src/kudu/security/test/mini_kdc.cc
M src/kudu/security/test/mini_kdc.h
8 files changed, 284 insertions(+), 43 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/20/5820/8
--
To view, visit http://gerrit.cloudera.org:8080/5820
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ic4c072c1210216369e60eac88be4a20d9b166b2d
Gerrit-PatchSet: 8
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Sailesh Mukil <[email protected]>
Gerrit-Reviewer: Adar Dembo <[email protected]>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Sailesh Mukil <[email protected]>
Gerrit-Reviewer: Tidy Bot
Gerrit-Reviewer: Todd Lipcon <[email protected]>
