Zoltan Chovan has posted comments on this change. ( http://gerrit.cloudera.org:8080/24293 )
Change subject: [java] Add JDK25 support ...................................................................... Patch Set 4: (3 comments) http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-client/src/test/java/org/apache/kudu/client/TestSecurity.java File java/kudu-client/src/test/java/org/apache/kudu/client/TestSecurity.java: http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-client/src/test/java/org/apache/kudu/client/TestSecurity.java@516 PS2, Line 516: // Reaching here means the default client principal could not connect to a > q: By removing the assertion on the exception message, this catch now accep Done — the catch now asserts anyOf(containsString("authenticat"), "SASL", "Kerberos", "GSS") instead of accepting any NonRecoverableException. Worth flagging: this tighter assertion caught a real bug. On JDK25 the test was failing not with an auth error but with a timeout — the negotiation failure was surfacing as "unexpected exception from downstream" (a recoverable error, retried to timeout) instead of a clean auth rejection. Root cause was in Negotiator.evaluateChallenge: it only unwrapped the legacy Subject.doAs wrapping (PrivilegedActionException), not the modern Subject.callAs wrapping (CompletionException) that the SecurityManagerCompatibility shim produces on JDK18+. So on JDK18+, Kerberos auth failures were being misclassified as recoverable network errors. I fixed evaluateChallenge to handle both wrappings; the test now passes on JDK17 and JDK25 and correctly matches the auth keyword. Thanks for pushing on this. http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduContext.scala File java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduContext.scala: http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-spark/src/main/scala/org/apache/kudu/spark/kudu/KuduContext.scala@589 PS2, Line 589: val principal = sc.getConf.getOption("spark.yarn.principal") > q: The catch clauses handle NoSuchMethodException, UnsupportedOperationExce Good catch — rather than broadening the catch around the reflection, I removed the reflection entirely. getSubject(sc): Subject (which reflected into Subject.current()) is replaced by getUGI(sc): UserGroupInformation, and the credential export now runs via ugi.doAs. It uses loginUserFromKeytabAndReturnUGI when spark.yarn.principal+keytab are set, otherwise UserGroupInformation.getCurrentUser(). Hadoop's UGI already encapsulates the JDK17-vs-JDK18+ Subject differences internally, so there's no reflection into javax.security.auth.Subject left in this class — the IllegalAccessException / SecurityException / strong-encapsulation failure modes you raised no longer apply. Verified on JDK25. http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-test-utils/src/main/java/org/apache/kudu/test/cluster/FakeDNS.java File java/kudu-test-utils/src/main/java/org/apache/kudu/test/cluster/FakeDNS.java: http://gerrit.cloudera.org:8080/#/c/24293/2/java/kudu-test-utils/src/main/java/org/apache/kudu/test/cluster/FakeDNS.java@111 PS2, Line 111: field.set(InetAddress.class, proxy); > Catching RuntimeException here is quite broad -- this will swallow NPEs, Cl Done, narrowed the Java 9+ path catch to ReflectiveOperationException | InaccessibleObjectException, i.e. the expected "this JDK doesn't have this API / reflective access blocked without --add-opens" failures. Genuine programming errors (NPE, ClassCastException, …) are no longer swallowed as "try the next JDK path", they propagate to the outer catch (ReflectiveOperationException | RuntimeException e), which rethrows them wrapped, so they surface instead of silently chaining into the next path. The other two paths (Java 25+ InetAddressResolver, Java 8 NameService) likewise catch only ReflectiveOperationException, and when all three fail the attempts are chained via addSuppressed (modern ? resolver ? legacy) so the reported error isn't confusing. -- To view, visit http://gerrit.cloudera.org:8080/24293 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I9d3835c9289ac9817c39a86b7be22a28818c5bb0 Gerrit-Change-Number: 24293 Gerrit-PatchSet: 4 Gerrit-Owner: Zoltan Chovan <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Reviewer: Zoltan Chovan <[email protected]> Gerrit-Comment-Date: Wed, 22 Jul 2026 14:20:26 +0000 Gerrit-HasComments: Yes
