Secure HBase with Java 8

[Adam Davidson <ad...@bigdatapartnership.com>]

Hi,

I'm working on a project to run a custom Java HBase client service on a
Kerberized cluster. We are using HBase 1.1 and Java 8.

We belief we have a setup that works in the first instance; the service
starts and logs in to Kerberos (UserGroupInformation.loginUserFromKeytab)
and proceeds to work as expected. The problem seems to come some time later
when the service tries to re-login the service principal; we see repeated
logs from the HBase AbstractRpcClient that it 'Couldn't set up connection
for service@REALM to hbase/_HOST@REALM' and we see timeouts when we try to
use the service.

The issue seems like it could be linked to a bug in hadoop-common library
where a change in the key caching in Java 8 leads to a silent failure to
re-login a service -https://issues.apache.org/jira/browse/HADOOP-10786. The
bug affects the common library up to version 2.6.0; I've noticed our
version of the HBase client uses an earlier version (2.5.1). I've seen this
related HBase JIRA - https://issues.apache.org/jira/browse/HBASE-7608. It
speculates on supporting Java 8 in HBase. Is this something that is still
under consideration i.e. is the Hadoop bug solved in HBase 1.1 or is it
reasonable to assume that I am actually encountering the same issue?

If it is this issue I can simply update the version of the hadoop-common
library in my code; however this breaks some integration tests I've set up
with the HBaseTestingUtility as a method it uses no longer exists in
hadoop-common 2.7.1

Regards,
Adam

-- 
 

*NOTICE AND DISCLAIMER*

This email (including attachments) is confidential. If you are not the 
intended recipient, notify the sender immediately, delete this email from 
your system and do not disclose or use for any purpose.

Business Address: Eagle House, 163 City Road, London, EC1V 1NR. United 
Kingdom
Registered Office: Finsgate, 5-7 Cranwood Street, London, EC1V 9EE. United 
Kingdom
Big Data Partnership Limited is a company registered in England & Wales 
with Company No 7904824

Re: Secure HBase with Java 8

[Andrew Purtell <ap...@apache.org>]

> is the Hadoop bug solved in HBase 1.1 or is it reasonable to assume that
I am actually encountering the same issue?

You should upgrade to a later Hadoop and recompile HBase with
-Dhadoop-two.version=<version> set to that version. Have you looked at the
patch releases in the 2.6.x series? The latest is 2.6.2. You might have
better luck with them than 2.7.1.

On Wed, Dec 9, 2015 at 8:14 AM, Adam Davidson <
adam.davidson@bigdatapartnership.com> wrote:

> Hi,
>
> I'm working on a project to run a custom Java HBase client service on a
> Kerberized cluster. We are using HBase 1.1 and Java 8.
>
> We belief we have a setup that works in the first instance; the service
> starts and logs in to Kerberos (UserGroupInformation.loginUserFromKeytab)
> and proceeds to work as expected. The problem seems to come some time later
> when the service tries to re-login the service principal; we see repeated
> logs from the HBase AbstractRpcClient that it 'Couldn't set up connection
> for service@REALM to hbase/_HOST@REALM' and we see timeouts when we try to
> use the service.
>
> The issue seems like it could be linked to a bug in hadoop-common library
> where a change in the key caching in Java 8 leads to a silent failure to
> re-login a service -https://issues.apache.org/jira/browse/HADOOP-10786.
> The
> bug affects the common library up to version 2.6.0; I've noticed our
> version of the HBase client uses an earlier version (2.5.1). I've seen this
> related HBase JIRA - https://issues.apache.org/jira/browse/HBASE-7608. It
> speculates on supporting Java 8 in HBase. Is this something that is still
> under consideration i.e. is the Hadoop bug solved in HBase 1.1 or is it
> reasonable to assume that I am actually encountering the same issue?
>
> If it is this issue I can simply update the version of the hadoop-common
> library in my code; however this breaks some integration tests I've set up
> with the HBaseTestingUtility as a method it uses no longer exists in
> hadoop-common 2.7.1
>
> Regards,
> Adam
>
> --
>
>
> *NOTICE AND DISCLAIMER*
>
> This email (including attachments) is confidential. If you are not the
> intended recipient, notify the sender immediately, delete this email from
> your system and do not disclose or use for any purpose.
>
> Business Address: Eagle House, 163 City Road, London, EC1V 1NR. United
> Kingdom
> Registered Office: Finsgate, 5-7 Cranwood Street, London, EC1V 9EE. United
> Kingdom
> Big Data Partnership Limited is a company registered in England & Wales
> with Company No 7904824
>



-- 
Best regards,

   - Andy

Problems worthy of attack prove their worth by hitting back. - Piet Hein
(via Tom White)