You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Gargi Jaiswal (Jira)" <ji...@apache.org> on 2025/12/02 12:42:00 UTC
[jira] [Updated] (HDDS-14064) Missing default value for "hdds.datanode.kerberos.principal
[ https://issues.apache.org/jira/browse/HDDS-14064?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gargi Jaiswal updated HDDS-14064:
---------------------------------
Description:
The configuration property
{code:java}
hdds.datanode.kerberos.principal{code}
in *ozone-default.xml* has an empty default value, while similar properties for SCM and OM have defaults (SCM/_HOST@REALM and OM/_HOST@REALM respectively). This inconsistency can lead to configuration errors in secure Ozone clusters.
*Current Behaviour:*
{code:java}
<property>
<name>hdds.datanode.kerberos.principal</name>
<value/> <!-- EMPTY -->
<tag>OZONE, DATANODE</tag>
<description>
The Datanode service principal. This is typically set to
dn/_HOST@REALM.TLD. Each Datanode will substitute _HOST with its
own fully qualified hostname at startup. The _HOST placeholder
allows using the same configuration setting on all Datanodes.
</description>
</property> {code}
This issue is identified when sending *DiskBalancer Commands* from client to DN in secure cluster.
Without a default, users must manually set this value, leading to potential misconfiguration and should be enabled by default.
Kerberos authentication fails with errors like:
{code:java}
Server has invalid Kerberos principal: dn/hostname@REALM, expecting: hdfs/hostname@REALM {code}
was:
The configuration property
{code:java}
hdds.datanode.kerberos.principal{code}
in *ozone-default.xml* has an empty default value, while similar properties for SCM and OM have defaults (SCM/_HOST@REALM and OM/_HOST@REALM respectively). This inconsistency can lead to configuration errors in secure Ozone clusters.
*Current Behaviour:*
{code:java}
<property>
<name>hdds.datanode.kerberos.principal</name>
<value/> <!-- EMPTY -->
<tag>OZONE, DATANODE</tag>
<description>
The Datanode service principal. This is typically set to
dn/_HOST@REALM.TLD. Each Datanode will substitute _HOST with its
own fully qualified hostname at startup. The _HOST placeholder
allows using the same configuration setting on all Datanodes.
</description>
</property> {code}
This issue is identified when sending *DiskBalancer Commands* from client to DN in secure cluster.
Without a default, users must manually set this value, leading to potential misconfiguration.
Kerberos authentication fails with errors like:
{code:java}
Server has invalid Kerberos principal: dn/hostname@REALM, expecting: hdfs/hostname@REALM {code}
> Missing default value for "hdds.datanode.kerberos.principal
> ------------------------------------------------------------
>
> Key: HDDS-14064
> URL: https://issues.apache.org/jira/browse/HDDS-14064
> Project: Apache Ozone
> Issue Type: Bug
> Reporter: Gargi Jaiswal
> Assignee: Gargi Jaiswal
> Priority: Major
>
> The configuration property
> {code:java}
> hdds.datanode.kerberos.principal{code}
> in *ozone-default.xml* has an empty default value, while similar properties for SCM and OM have defaults (SCM/_HOST@REALM and OM/_HOST@REALM respectively). This inconsistency can lead to configuration errors in secure Ozone clusters.
> *Current Behaviour:*
> {code:java}
> <property>
> <name>hdds.datanode.kerberos.principal</name>
> <value/> <!-- EMPTY -->
> <tag>OZONE, DATANODE</tag>
> <description>
> The Datanode service principal. This is typically set to
> dn/_HOST@REALM.TLD. Each Datanode will substitute _HOST with its
> own fully qualified hostname at startup. The _HOST placeholder
> allows using the same configuration setting on all Datanodes.
> </description>
> </property> {code}
> This issue is identified when sending *DiskBalancer Commands* from client to DN in secure cluster.
> Without a default, users must manually set this value, leading to potential misconfiguration and should be enabled by default.
> Kerberos authentication fails with errors like:
> {code:java}
> Server has invalid Kerberos principal: dn/hostname@REALM, expecting: hdfs/hostname@REALM {code}
>
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org