Kerberized PutKudu

[DEHAY Aurelien <au...@faurecia.com>]

Classification\_- INTERNAL & PARTNERS

Hello.

I still have some issues with the kerberized PutKudu on my 1.9.2 nifi cluster:

2019-08-01 16:15:28,207 DEBUG [Timer-Driven Process Thread-64] o.a.n.security.krb.AbstractKerberosUser TGT was found, but has not reached expiration window
2019-08-01 16:15:28,279 WARN [New I/O worker #36] org.apache.kudu.util.NetUtil Slow DNS lookup! Resolved IP of `par01prdmgt2.soft.fau' to par01prdmgt2.soft.fau/10.126.94.77 in 3731271ns
2019-08-01 16:15:28,291 WARN [New I/O worker #37] org.apache.kudu.client.SecurityContext Caller-provided Subject has a Kerberos ticket that is about to expire. Kudu expects the application to renew or re-acquire its own tickets before expiration.
2019-08-01 16:15:28,321 WARN [New I/O worker #37] org.apache.kudu.client.AsyncKuduSession unexpected tablet lookup failure for operation KuduRpc(method=Write, tablet=null, attempt=0, DeadlineTracker(timeout=0, elapsed=113), No traces)
org.apache.kudu.client.NonRecoverableException: cannot re-acquire authentication token after 5 attempts (Couldn't find a valid master in (par01prdmgt1.soft.fau:7051,par01prdmgt2.soft.fau:7051,par01prdmgt3.soft.fau:7051). Exceptions received: [org.apache.kudu.client.NonRecoverableException: server requires authentication, but client does not have Kerberos credentials (tgt). Authentication tokens were not used because this connection will be used to acquire a new token and therefore requires primary credentials, org.apache.kudu.client.NonRecoverableException: server requires authentication, but client does not have Kerberos credentials (tgt). Authentication tokens were not used because this connection will be used to acquire a new token and therefore requires primary credentials, org.apache.kudu.client.NonRecoverableException: server requires authentication, but client does not have Kerberos credentials (tgt). Authentication tokens were not used because this connection will be used to acquire a new token and therefore requires primary credentials])
        at org.apache.kudu.client.AuthnTokenReacquirer$1NewAuthnTokenErrB.call(AuthnTokenReacquirer.java:158)
        at org.apache.kudu.client.AuthnTokenReacquirer$1NewAuthnTokenErrB.call(AuthnTokenReacquirer.java:141)
        at com.stumbleupon.async.Deferred.doCall(Deferred.java:1280)
        at com.stumbleupon.async.Deferred.runCallbacks(Deferred.java:1259)
        at com.stumbleupon.async.Deferred.callback(Deferred.java:1002)
        at org.apache.kudu.client.ConnectToCluster.incrementCountAndCheckExhausted(ConnectToCluster.java:246)
        at org.apache.kudu.client.ConnectToCluster.access$100(ConnectToCluster.java:49)
        at org.apache.kudu.client.ConnectToCluster$ConnectToMasterErrCB.call(ConnectToCluster.java:365)
        at org.apache.kudu.client.ConnectToCluster$ConnectToMasterErrCB.call(ConnectToCluster.java:354)Aurélien DEHAY


I restart the processors and everything works just fine again. I have this error every approximatively 7 days. I don't know if it's a processor Kerberos configuration (even if in the keytab Kerberos service there is not much conf), the kerberos conf of the server or the Kerberos service.

Any pointer would greatly help, thanks.

Aurélien.

This electronic transmission (and any attachments thereto) is intended solely for the use of the addressee(s). It may contain confidential or legally privileged information. If you are not the intended recipient of this message, you must delete it immediately and notify the sender. Any unauthorized use or disclosure of this message is strictly prohibited.  Faurecia does not guarantee the integrity of this transmission and shall therefore never be liable if the message is altered or falsified nor for any virus, interception or damage to your system.