Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[feat](catalog)Replace HadoopUGI with HadoopKerberosAuthenticator to Support Kerberos Ticket Auto-Renewal #44916

Merged
merged 3 commits into from
Dec 6, 2024
Merged

[feat](catalog)Replace HadoopUGI with HadoopKerberosAuthenticator to Support Kerberos Ticket Auto-Renewal #44916

merged 3 commits into from
Dec 6, 2024

Conversation

CalvinKirs
Copy link
Member

@CalvinKirs CalvinKirs commented Dec 3, 2024 •
edited
Loading

Background

The current implementation uses the HadoopUGI method, which invokes the ugiDoAs function for each operation to log in and execute actions based on the configuration. However, this approach has the following issues:

  • Lack of Auto-Renewal: If the Kerberos TGT (Ticket Granting Ticket) expires, manual re-login is required as there is no support for automatic ticket renewal.
  • Redundant Login Overhead: Each operation requires reinitializing or checking UserGroupInformation, potentially causing performance bottlenecks.
  • Complex Management: The HadoopUGI design does not unify the lifecycle management of UGI instances, leading to duplicated logic across the codebase.

Objective

  • Auto-Renewal: Automatically renew Kerberos credentials when the TGT is expired or near expiry.
  • UGI Caching: Maintain reusable UserGroupInformation instances during their lifecycle to avoid repetitive logins.
  • Unified Management: Simplify the management of UGI instances and Kerberos credentials.

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason

  • Behavior changed:

    • No.
    • Yes.

  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@CalvinKirs
[feat](catalog)Replace HadoopUGI with HadoopKerberosAuthenticator to …
8484bb9 
…Support Kerberos Ticket Auto-Renewal

### Background
The current implementation uses the HadoopUGI method, which invokes the ugiDoAs function for each operation to log in and execute actions based on the configuration. However, this approach has the following issues:

- Lack of Auto-Renewal: If the Kerberos TGT (Ticket Granting Ticket) expires, manual re-login is required as there is no support for automatic ticket renewal.
- Redundant Login Overhead: Each operation requires reinitializing or checking UserGroupInformation, potentially causing performance bottlenecks.
- Complex Management: The HadoopUGI design does not unify the lifecycle management of UGI instances, leading to duplicated logic across the codebase.
### Objective

- Auto-Renewal: Automatically renew Kerberos credentials when the TGT is expired or near expiry.
- UGI Caching: Maintain reusable UserGroupInformation instances during their lifecycle to avoid repetitive logins.
- Unified Management: Simplify the management of UGI instances and Kerberos credentials.
@doris-robot
Copy link

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@CalvinKirs
Copy link
Member Author

run buildall

morningman
morningman previously approved these changes Dec 4, 2024
View reviewed changes
@CalvinKirs
Merge remote-tracking branch 'refs/remotes/upstream/master' into mast…
7ca7988 
…er-hadoop-ugi-replace

# Conflicts:
#	fe/be-java-extensions/hudi-scanner/src/main/java/org/apache/doris/hudi/Utils.java
#	fe/fe-core/src/main/java/org/apache/doris/datasource/hive/HiveMetaStoreClientHelper.java
@CalvinKirs
fix checkstyle
565bb97
@CalvinKirs
Copy link
Member Author

run buildall

morningman
morningman approved these changes Dec 6, 2024
View reviewed changes
Copy link
Contributor

@morningman morningman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

PR approved by at least one committer and no changes requested.

@github-actions github-actions bot added approved Indicates a PR has been approved by one committer. reviewed labels Dec 6, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

PR approved by anyone and no changes requested.

@morningman morningman merged commit 0671f57 into apache:master Dec 6, 2024
26 of 28 checks passed
github-actions bot pushed a commit that referenced this pull request Dec 6, 2024
@CalvinKirs
[feat](catalog)Replace HadoopUGI with HadoopKerberosAuthenticator to …
a55d3da 
…Support Kerberos Ticket Auto-Renewal (#44916)

### Background
The current implementation uses the HadoopUGI method, which invokes the
ugiDoAs function for each operation to log in and execute actions based
on the configuration. However, this approach has the following issues:

- Lack of Auto-Renewal: If the Kerberos TGT (Ticket Granting Ticket)
expires, manual re-login is required as there is no support for
automatic ticket renewal.
- Redundant Login Overhead: Each operation requires reinitializing or
checking UserGroupInformation, potentially causing performance
bottlenecks.
- Complex Management: The HadoopUGI design does not unify the lifecycle
management of UGI instances, leading to duplicated logic across the
codebase.
### Objective

- Auto-Renewal: Automatically renew Kerberos credentials when the TGT is
expired or near expiry.
- UGI Caching: Maintain reusable UserGroupInformation instances during
their lifecycle to avoid repetitive logins.
- Unified Management: Simplify the management of UGI instances and
Kerberos credentials.
@github-actions github-actions bot mentioned this pull request Dec 6, 2024
Merged
github-actions bot pushed a commit that referenced this pull request Dec 6, 2024
@CalvinKirs
[feat](catalog)Replace HadoopUGI with HadoopKerberosAuthenticator to …
8812db3 
…Support Kerberos Ticket Auto-Renewal (#44916)

### Background
The current implementation uses the HadoopUGI method, which invokes the
ugiDoAs function for each operation to log in and execute actions based
on the configuration. However, this approach has the following issues:

- Lack of Auto-Renewal: If the Kerberos TGT (Ticket Granting Ticket)
expires, manual re-login is required as there is no support for
automatic ticket renewal.
- Redundant Login Overhead: Each operation requires reinitializing or
checking UserGroupInformation, potentially causing performance
bottlenecks.
- Complex Management: The HadoopUGI design does not unify the lifecycle
management of UGI instances, leading to duplicated logic across the
codebase.
### Objective

- Auto-Renewal: Automatically renew Kerberos credentials when the TGT is
expired or near expiry.
- UGI Caching: Maintain reusable UserGroupInformation instances during
their lifecycle to avoid repetitive logins.
- Unified Management: Simplify the management of UGI instances and
Kerberos credentials.
@github-actions github-actions bot mentioned this pull request Dec 6, 2024
Merged
morningman pushed a commit that referenced this pull request Dec 7, 2024
@github-actions @CalvinKirs
branch-2.1: [feat](catalog)Replace HadoopUGI with HadoopKerberosAuthe…
3714063 
…nticator to Support Kerberos Ticket Auto-Renewal #44916 (#45138)

Cherry-picked from #44916

Co-authored-by: Calvin Kirs <[email protected]>
morningman pushed a commit that referenced this pull request Dec 7, 2024
@github-actions @CalvinKirs
branch-3.0: [feat](catalog)Replace HadoopUGI with HadoopKerberosAuthe…
3ed7c55 
…nticator to Support Kerberos Ticket Auto-Renewal #44916 (#45137)

Cherry-picked from #44916

Co-authored-by: Calvin Kirs <[email protected]>
@CalvinKirs CalvinKirs deleted the master-hadoop-ugi-replace branch January 16, 2025 09:34
@yiguolei yiguolei mentioned this pull request Jan 19, 2025
Open
@gavinchou gavinchou mentioned this pull request Feb 18, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@morningman morningman morningman approved these changes

@hubgeter hubgeter hubgeter approved these changes

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by one committer. dev/2.1.8-merged dev/3.0.4-merged reviewed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@CalvinKirs @doris-robot @morningman @hubgeter