Todd Lipcon has submitted this change and it was merged. Change subject: KUDU-1845: Kerberos client keytab should be periodically renewed ......................................................................
KUDU-1845: Kerberos client keytab should be periodically renewed With the current kerberos support, if a ticket expires, all communication on a secure cluster would stop as we do not attempt to renew the ticket. This patch adds a renewal thread which periodically wakes up and either renews the Ticket Granting Ticket or acquires a new one if the renewal window is closed. The renew interval is controlled by a newly introduced flag called 'kerberos_reinit_interval'. A reader-writer lock is used to avoid a race at the time of ticket reinitializtaion, which can occur between the time the credential cache is reinitialized and the time the new credentials are placed in the cache. The reader lock is taken before any call to the SASL library (if kerberos is enabled) and the writer lock is taken before reinitializing the cache and placing the new creds in it. Testing: Added 2 tests, one for ticket renewal and one for ticket reacquisition. I haven't added tests to confirm if disabling the renew thread makes these tests fail as that would require quite some plumbing which I think is unnecessary. Instead, I manually tested that disabling the renew thread causes the tests to fail. Change-Id: Ic4c072c1210216369e60eac88be4a20d9b166b2d Reviewed-on: http://gerrit.cloudera.org:8080/5820 Tested-by: Kudu Jenkins Reviewed-by: Todd Lipcon <[email protected]> --- M src/kudu/integration-tests/external_mini_cluster-test.cc M src/kudu/integration-tests/external_mini_cluster.cc M src/kudu/integration-tests/external_mini_cluster.h M src/kudu/rpc/sasl_common.cc M src/kudu/security/init.cc M src/kudu/security/init.h M src/kudu/security/test/mini_kdc.cc M src/kudu/security/test/mini_kdc.h 8 files changed, 318 insertions(+), 43 deletions(-) Approvals: Todd Lipcon: Looks good to me, approved Kudu Jenkins: Verified -- To view, visit http://gerrit.cloudera.org:8080/5820 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ic4c072c1210216369e60eac88be4a20d9b166b2d Gerrit-PatchSet: 11 Gerrit-Project: kudu Gerrit-Branch: master Gerrit-Owner: Sailesh Mukil <[email protected]> Gerrit-Reviewer: Adar Dembo <[email protected]> Gerrit-Reviewer: Kudu Jenkins Gerrit-Reviewer: Sailesh Mukil <[email protected]> Gerrit-Reviewer: Tidy Bot Gerrit-Reviewer: Todd Lipcon <[email protected]>
