Attila Bukor has posted comments on this change. ( http://gerrit.cloudera.org:8080/15601 )
Change subject: KUDU-3081 Add Kerberos support to MiniRanger ...................................................................... Patch Set 7: (2 comments) http://gerrit.cloudera.org:8080/#/c/15601/4/src/kudu/ranger/mini_ranger.cc File src/kudu/ranger/mini_ranger.cc: http://gerrit.cloudera.org:8080/#/c/15601/4/src/kudu/ranger/mini_ranger.cc@206 PS4, Line 206: string krb5_config = getenv("KRB5_CONFIG"); > +1 to what Andrew said, and yeah, I do feel strongly about this (provided i This is the one that's set by MiniKdc if it's started from EMC. https://github.com/apache/kudu/blob/737fbdd3f0e751241a2128634b41488d7cb6c790/src/kudu/security/test/mini_kdc.cc#L86 https://github.com/apache/kudu/blob/737fbdd3f0e751241a2128634b41488d7cb6c790/src/kudu/security/test/mini_kdc.cc#L356-L358 MiniRanger and Ranger plugin actually didn't work with Kerberos enabled and java.security.krb5.conf set to the value of KRB5_CONFIG in EMC which is how I realized I need to set it. I posted my concerns about the non-env var approach on the other thread, please let me know what you think. http://gerrit.cloudera.org:8080/#/c/15601/4/src/kudu/ranger/ranger_client.cc File src/kudu/ranger/ranger_client.cc: http://gerrit.cloudera.org:8080/#/c/15601/4/src/kudu/ranger/ranger_client.cc@195 PS4, Line 195: string krb5_config = getenv("KRB5_CONFIG"); > The problem is that it's much tougher to track and understand the behavior My issue with this approach is that KRB5_CONFIG is actually respected in Kudu right now (just tested it on a lab cluster to make sure), so this would technically be a breaking change. If someone has set KRB5_CONFIG to something other than /etc/krb5.conf and it will suddenly stop working after they enable Ranger. I would say it would be even harder to understand why Kudu works, but Ranger integration doesn't. How about we default to KRB5_CONFIG and document it and also add a flag that can override it and the description also mentions it defaults to $KRB5_CONFIG? -- To view, visit http://gerrit.cloudera.org:8080/15601 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I32118780ad912791fe5e371004345428b6459549 Gerrit-Change-Number: 15601 Gerrit-PatchSet: 7 Gerrit-Owner: Attila Bukor <[email protected]> Gerrit-Reviewer: Adar Dembo <[email protected]> Gerrit-Reviewer: Andrew Wong <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Grant Henke <[email protected]> Gerrit-Reviewer: Hao Hao <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Tidy Bot (241) Gerrit-Comment-Date: Wed, 01 Apr 2020 09:25:28 +0000 Gerrit-HasComments: Yes
