You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ambari.apache.org by "Robert Ketcherside (JIRA)" <ji...@apache.org> on 2016/06/10 20:13:21 UTC
[jira] [Updated] (AMBARI-17155) Accumulo Tracer principal causes
OneFS permissions conflict
[ https://issues.apache.org/jira/browse/AMBARI-17155?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Ketcherside updated AMBARI-17155:
----------------------------------------
Description:
The default principal for trace.user {code:|borderStyle=solid}tracer-${cluster-name}@${realm}{code} causes Accumulo Tracer to be unable to start once Kerberos is enabled in an environment where the NameNode and DataNode are an EMC/Isilon OneFS cluster.
Unlike the Apache NameNode, OneFS doesn't have a user-defined auto_to_local mapping for principals to local users. It just takes the root of the principal and looks for a local user of the same name.
Tracer uses its upn in order to auth to hdfs and read the value of the file within the "instance_id" directory, and the name of the directory within "version" under apps/accumulo/data. If these steps fail, the component dies.
Currently Isilon is advising customers to switch the principal name to {code:|borderStyle=solid}${accumulo-env/accumulo_user}@${realm}{code}. The Accumulo user already has read access to the contents of the data directory. (Hence, this issue is filed as minor; there is a work around.)
An admin could also resolve the permissions issue for the tracer principal by giving o+r permissions recursively to the accumulo directory; or by creating a tracer user, adding it to a group like hadoop, and changing group ownership of the apps/accumulo direcotry to o+r recursively.
I'm filing this JIRA to ask for a resolution to be investigated on the Apache side. Here are a few ideas, though they might not be valid courses of action:
- Use an Accumulo upn or spn for kerberized trace.user. SPN is indicated as default in the Accumulo manual, https://accumulo.apache.org/1.7/accumulo_user_manual#_kerberos .
- Have Accumulo Tracer check hdfs as a different principal.
- Remove Accumulo Tracer's requirement to read information from the file system as a prerequisite to service start.
See https://community.emc.com/community/products/isilon/blog/2016/06/03/onefs-ambari-and-accumulo-tracer for more details.
was:
The default principal for trace.user (tracer-${cluster-name}@${realm}) causes Accumulo Tracer to be unable to start once Kerberos is enabled in an environment where the NameNode and DataNode are an EMC/Isilon OneFS cluster.
Unlike the Apache NameNode, OneFS doesn't have a user-defined auto_to_local mapping for principals to local users. It just takes the root of the principal and looks for a local user of the same name.
Tracer uses its upn in order to auth to hdfs and read the value of the file within the "instance_id" directory, and the name of the directory within "version" under apps/accumulo/data. If these steps fail, the component dies.
Currently Isilon is advising customers to switch the principal name to ${accumulo-env/accumulo_user}@${realm}. The Accumulo user already has read access to the contents of the data directory. (Hence, this issue is filed as minor; there is a work around.)
An admin could also resolve the permissions issue for the tracer principal by giving o+r permissions recursively to the accumulo directory; or by creating a tracer user, adding it to a group like hadoop, and changing group ownership of the apps/accumulo direcotry to o+r recursively.
I'm filing this JIRA to ask for a resolution to be investigated on the Apache side. Here are a few ideas, though they might not be valid courses of action:
- Use an Accumulo upn or spn for kerberized trace.user. SPN is indicated as default in the Accumulo manual, https://accumulo.apache.org/1.7/accumulo_user_manual#_kerberos .
- Have Accumulo Tracer check hdfs as a different principal.
- Remove Accumulo Tracer's requirement to read information from the file system as a prerequisite to service start.
See https://community.emc.com/community/products/isilon/blog/2016/06/03/onefs-ambari-and-accumulo-tracer for more details.
> Accumulo Tracer principal causes OneFS permissions conflict
> -----------------------------------------------------------
>
> Key: AMBARI-17155
> URL: https://issues.apache.org/jira/browse/AMBARI-17155
> Project: Ambari
> Issue Type: Bug
> Components: ambari-server
> Affects Versions: 2.2.2
> Environment: Ambari 2.2.2, HDP 2.4.2, OneFS 8.0.0.1
> Reporter: Robert Ketcherside
> Priority: Minor
>
> The default principal for trace.user {code:|borderStyle=solid}tracer-${cluster-name}@${realm}{code} causes Accumulo Tracer to be unable to start once Kerberos is enabled in an environment where the NameNode and DataNode are an EMC/Isilon OneFS cluster.
> Unlike the Apache NameNode, OneFS doesn't have a user-defined auto_to_local mapping for principals to local users. It just takes the root of the principal and looks for a local user of the same name.
> Tracer uses its upn in order to auth to hdfs and read the value of the file within the "instance_id" directory, and the name of the directory within "version" under apps/accumulo/data. If these steps fail, the component dies.
> Currently Isilon is advising customers to switch the principal name to {code:|borderStyle=solid}${accumulo-env/accumulo_user}@${realm}{code}. The Accumulo user already has read access to the contents of the data directory. (Hence, this issue is filed as minor; there is a work around.)
> An admin could also resolve the permissions issue for the tracer principal by giving o+r permissions recursively to the accumulo directory; or by creating a tracer user, adding it to a group like hadoop, and changing group ownership of the apps/accumulo direcotry to o+r recursively.
> I'm filing this JIRA to ask for a resolution to be investigated on the Apache side. Here are a few ideas, though they might not be valid courses of action:
> - Use an Accumulo upn or spn for kerberized trace.user. SPN is indicated as default in the Accumulo manual, https://accumulo.apache.org/1.7/accumulo_user_manual#_kerberos .
> - Have Accumulo Tracer check hdfs as a different principal.
> - Remove Accumulo Tracer's requirement to read information from the file system as a prerequisite to service start.
> See https://community.emc.com/community/products/isilon/blog/2016/06/03/onefs-ambari-and-accumulo-tracer for more details.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)