[jira] [Created] (HBASE-30432) [Thrift] Add hostname override support for ThriftServer

["Jack Yang (Jira)" <ji...@apache.org>]

Jack Yang created HBASE-30432:
---------------------------------

             Summary: [Thrift] Add hostname override support for ThriftServer
                 Key: HBASE-30432
                 URL: https://issues.apache.org/jira/browse/HBASE-30432
             Project: HBase
          Issue Type: Improvement
          Components: security, Thrift
    Affects Versions: 2.4.15
            Reporter: Jack Yang


When HBase ThriftServer runs with Kerberos/SASL enabled, it determines its hostname using:

{{}}
{code:java}
DNS.getDefaultHost( 
    conf.get(THRIFT_DNS_INTERFACE_KEY, "default"), 
    conf.get(THRIFT_DNS_NAMESERVER_KEY, "default")){code}
{{}}

The resulting hostname is then used for Kerberos login and as the SASL server hostname.

This works well when clients connect directly to the physical hostname of each ThriftServer, but causes problems when multiple ThriftServer instances are exposed through a common service hostname, for example using DNS round-robin, a VIP, or an L4 load balancer.

Example deployment:

{{}}
{code:java}
hbase-thrift.example.com 
A -> 10.0.0.11 (host1) 
A -> 10.0.0.12 (host2) 
A -> 10.0.0.13 (host3){code}
{{}}

Clients connect to:

{{}}
{code:java}
hbase-thrift.example.com:9090{code}
{{}}

and therefore use the Kerberos service principal:

{{}}
{code:java}
hbase/hbase-thrift.example.com@EXAMPLE.COM{code}
{{}}

However, each ThriftServer currently discovers its physical hostname using {{{}DNS.getDefaultHost(){}}}, for example:

{{}}
{code:java}
host1 
host2 
host3{code}
{{}}

and initializes its SASL server using those hostnames.

This results in a mismatch between the service hostname used by the client and the hostname used by the ThriftServer SASL endpoint.

The existing configurations:

{{}}
{code:java}
hbase.thrift.dns.interface hbase.thrift.dns.nameserver
{code}
{{}}

allow selecting the interface and DNS server used for hostname discovery, but do not provide a way to explicitly override the hostname used by ThriftServer.

Changing the operating system hostname, {{{}/etc/hosts{}}}, or reverse DNS is not always desirable because the same hosts may run other Hadoop services such as HDFS, whose Kerberos principals depend on their physical hostnames.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)