[GitHub] [flink] gaborgsomogyi commented on a diff in pull request #19372: [FLINK-26043][runtime][security] Add periodic kerberos relogin to KerberosDelegationTokenManager

[GitBox <gi...@apache.org>]

gaborgsomogyi commented on code in PR #19372:
URL: https://github.com/apache/flink/pull/19372#discussion_r847297674


##########
flink-runtime/src/main/java/org/apache/flink/runtime/security/token/KerberosDelegationTokenManager.java:
##########
@@ -110,13 +126,84 @@ public void obtainDelegationTokens(Credentials credentials) {
      * task managers.
      */
     @Override
-    public void start() {
-        LOG.info("Starting renewal task");
+    public void start() throws Exception {
+        checkState(renewalExecutor == null, "Manager is already started");
+
+        if (!isRenewalPossible()) {
+            LOG.info("Renewal is NOT possible, skipping to start renewal task");
+            return;
+        }
+
+        ThreadFactory threadFactory =
+                new ThreadFactoryBuilder()
+                        .setDaemon(true)
+                        .setNameFormat("Credential Renewal Thread")
+                        .build();
+        renewalExecutor = new ScheduledThreadPoolExecutor(1, threadFactory);
+        // By default, a cancelled task is not automatically removed from the work queue until its
+        // delay elapses. We have to enable it manually.
+        renewalExecutor.setRemoveOnCancelPolicy(true);
+
+        startTGTRenewal();
+    }
+
+    @VisibleForTesting
+    boolean isRenewalPossible() throws IOException {
+        if (!StringUtils.isBlank(securityConfiguration.getKeytab())
+                && !StringUtils.isBlank(securityConfiguration.getPrincipal())) {
+            LOG.debug("Login from keytab is possible");
+            return true;
+        }
+        LOG.debug("Login from keytab is NOT possible");
+
+        if (securityConfiguration.useTicketCache()
+                && UserGroupInformation.getCurrentUser().hasKerberosCredentials()) {
+            LOG.debug("Login from ticket cache is possible");
+            return true;
+        }
+        LOG.debug("Login from ticket cache is NOT possible");
+
+        return false;
+    }
+
+    private void startTGTRenewal() throws IOException {
+        LOG.debug("Starting credential renewal task");
+
+        UserGroupInformation currentUser = UserGroupInformation.getCurrentUser();
+        if (currentUser.isFromKeytab()) {
+            // In Hadoop 2.x, renewal of the keytab-based login seems to be automatic, but in Hadoop
+            // 3.x, it is configurable (see hadoop.kerberos.keytab.login.autorenewal.enabled, added
+            // in HADOOP-9567). This task will make sure that the user stays logged in regardless of
+            // that configuration's value. Note that checkTGTAndReloginFromKeytab() is a no-op if
+            // the TGT does not need to be renewed yet.
+            Runnable tgtRenewalTask =
+                    () -> {
+                        try {
+                            LOG.debug("Renewing TGT");
+                            currentUser.checkTGTAndReloginFromKeytab();
+                            LOG.debug("TGT renewed successfully");
+                        } catch (Exception e) {
+                            LOG.error("Error while renewing TGT", e);

Review Comment:
   Since we retry it makes sense so changed.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org