You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@accumulo.apache.org by "Josh Elser (JIRA)" <ji...@apache.org> on 2015/03/03 20:22:05 UTC
[jira] [Commented] (ACCUMULO-3599) Get more (all) ITs running with
Kerberos
[ https://issues.apache.org/jira/browse/ACCUMULO-3599?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14345564#comment-14345564 ]
Josh Elser commented on ACCUMULO-3599:
--------------------------------------
I got to a point where all of the ITs are passing with a normal MAC and a MAC which is using Kerberos via Hadoop's MiniKdc. There were a few tests (those which tried to run MapReduce) which I just ignore when we're running with Kerberos on as I haven't figured out how I can actually get these working (do I just need to construct an inline Configuration with the necessary properties?).
The short of it is that new ITs which only perform some task as the "root" user shouldn't have changed. Use the {{getConnector}} method and things should be fine -- the test harness will do the work for you depending on the environment. If the test uses multiple users, doesn't anything with user mgmt (e.g. {{createLocalUser}}), then things get a little different. Still a TBD to update the docs.
A secondary goal of the above was to make sure that the changes made to support MAC w/ or w/o Kerberos also support a standalone cluster with Kerberos. I've already found an issue in the first test class I ran, so I anticipate more changes to come, but I wanted to get this in while I know it's in a good state.
As always, if you notice new test failures, feel free to open a new issue and assign it to me.
> Get more (all) ITs running with Kerberos
> ----------------------------------------
>
> Key: ACCUMULO-3599
> URL: https://issues.apache.org/jira/browse/ACCUMULO-3599
> Project: Accumulo
> Issue Type: Test
> Components: test
> Reporter: Josh Elser
> Assignee: Josh Elser
> Fix For: 1.7.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> As a part of ACCUMULO-2815 and ACCUMULO-3513, a KerberosIT was added that work, although there is no way to run the existing IT suite against a secure cluster.
> It would be ideal to be able to run all tests against an Accumulo cluster using Kerberos, even better would be the ability to have a {{-DuseKerberosForITs}} flag like SSL.
> The big change will be the management of users as PasswordTokens will no longer be valid. Creating and using keytabs for test users isn't an issue, but avoiding rewriting every test with a conditional block might be tricky since we currently have no use of {{UserGroupInformation}} in our normal tests.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
Fwd: [jira] [Commented] (ACCUMULO-3599) Get more (all) ITs running
with Kerberos
Posted by Josh Elser <jo...@gmail.com>.
Heads-up:
This was a big changset, but shouldn't have any significant impact out
of the scope of integration tests.
If you see ITs start failing that previously did not, let me know and I
can look into 'em (since I likely broke them). Normal `mvn verify`
invocations should still all be passing (as is our contract).
-------- Original Message --------
Subject: [jira] [Commented] (ACCUMULO-3599) Get more (all) ITs running
with Kerberos
Date: Tue, 3 Mar 2015 19:22:05 +0000 (UTC)
From: Josh Elser (JIRA) <ji...@apache.org>
Reply-To: jira@apache.org
To: notifications@accumulo.apache.org
[
https://issues.apache.org/jira/browse/ACCUMULO-3599?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14345564#comment-14345564
]
Josh Elser commented on ACCUMULO-3599:
--------------------------------------
I got to a point where all of the ITs are passing with a normal MAC and
a MAC which is using Kerberos via Hadoop's MiniKdc. There were a few
tests (those which tried to run MapReduce) which I just ignore when
we're running with Kerberos on as I haven't figured out how I can
actually get these working (do I just need to construct an inline
Configuration with the necessary properties?).
The short of it is that new ITs which only perform some task as the
"root" user shouldn't have changed. Use the {{getConnector}} method and
things should be fine -- the test harness will do the work for you
depending on the environment. If the test uses multiple users, doesn't
anything with user mgmt (e.g. {{createLocalUser}}), then things get a
little different. Still a TBD to update the docs.
A secondary goal of the above was to make sure that the changes made to
support MAC w/ or w/o Kerberos also support a standalone cluster with
Kerberos. I've already found an issue in the first test class I ran, so
I anticipate more changes to come, but I wanted to get this in while I
know it's in a good state.
As always, if you notice new test failures, feel free to open a new
issue and assign it to me.
> Get more (all) ITs running with Kerberos
> ----------------------------------------
>
> Key: ACCUMULO-3599
> URL: https://issues.apache.org/jira/browse/ACCUMULO-3599
> Project: Accumulo
> Issue Type: Test
> Components: test
> Reporter: Josh Elser
> Assignee: Josh Elser
> Fix For: 1.7.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> As a part of ACCUMULO-2815 and ACCUMULO-3513, a KerberosIT was added that work, although there is no way to run the existing IT suite against a secure cluster.
> It would be ideal to be able to run all tests against an Accumulo cluster using Kerberos, even better would be the ability to have a {{-DuseKerberosForITs}} flag like SSL.
> The big change will be the management of users as PasswordTokens will no longer be valid. Creating and using keytabs for test users isn't an issue, but avoiding rewriting every test with a conditional block might be tricky since we currently have no use of {{UserGroupInformation}} in our normal tests.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)