This is an automated email from the ASF dual-hosted git repository.
junegunn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hbase.git
The following commit(s) were added to refs/heads/master by this push:
new 6f8a495a116 HBASE-30432 Add hostname override support for ThriftServer (#8712)
6f8a495a116 is described below
commit 6f8a495a1163c33b4ae7c0f8cc87de7718f26433
Author: jacklove2run <52...@qq.com>
AuthorDate: Fri Oct 2 13:13:01 2026 +0800
HBASE-30432 Add hostname override support for ThriftServer (#8712)
Signed-off-by: Junegunn Choi <ju...@apache.org>
---
.../java/org/apache/hadoop/hbase/util/DNS.java | 8 ++++-
.../java/org/apache/hadoop/hbase/util/TestDNS.java | 41 ++++++++++++++++++++++
.../apache/hadoop/hbase/thrift/ThriftServer.java | 7 +---
.../_mdx/(multi-page)/security/client-access.mdx | 13 +++++++
4 files changed, 62 insertions(+), 7 deletions(-)
diff --git a/hbase-common/src/main/java/org/apache/hadoop/hbase/util/DNS.java b/hbase-common/src/main/java/org/apache/hadoop/hbase/util/DNS.java
index d78df01c82f..e5cd38cae6c 100644
--- a/hbase-common/src/main/java/org/apache/hadoop/hbase/util/DNS.java
+++ b/hbase-common/src/main/java/org/apache/hadoop/hbase/util/DNS.java
@@ -38,6 +38,8 @@ public final class DNS {
public static final String UNSAFE_RS_HOSTNAME_KEY = "hbase.unsafe.regionserver.hostname";
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
public static final String MASTER_HOSTNAME_KEY = "hbase.master.hostname";
+ @InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
+ public static final String UNSAFE_THRIFT_HOSTNAME_KEY = "hbase.unsafe.thrift.hostname";
private static boolean HAS_NEW_DNS_GET_DEFAULT_HOST_API;
private static Method GET_DEFAULT_HOST_METHOD;
@@ -64,7 +66,8 @@ public final class DNS {
public enum ServerType {
MASTER("master"),
- REGIONSERVER("regionserver");
+ REGIONSERVER("regionserver"),
+ THRIFT("thrift");
private final String name;
@@ -119,6 +122,9 @@ public final class DNS {
case REGIONSERVER:
hostname = conf.get(UNSAFE_RS_HOSTNAME_KEY);
break;
+ case THRIFT:
+ hostname = conf.get(UNSAFE_THRIFT_HOSTNAME_KEY);
+ break;
default:
hostname = null;
}
diff --git a/hbase-common/src/test/java/org/apache/hadoop/hbase/util/TestDNS.java b/hbase-common/src/test/java/org/apache/hadoop/hbase/util/TestDNS.java
new file mode 100644
index 00000000000..cb4d61e952c
--- /dev/null
+++ b/hbase-common/src/test/java/org/apache/hadoop/hbase/util/TestDNS.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.hbase.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.hbase.testclassification.MiscTests;
+import org.apache.hadoop.hbase.testclassification.SmallTests;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag(MiscTests.TAG)
+@Tag(SmallTests.TAG)
+public class TestDNS {
+
+ @Test
+ public void testThriftHostnameOverride() throws Exception {
+ Configuration conf = new Configuration(false);
+ conf.set(DNS.UNSAFE_THRIFT_HOSTNAME_KEY, "hbase-thrift.example.com");
+ // If the hostname override is honored, DNS discovery is not attempted.
+ conf.set("hbase.thrift.dns.interface", "interface-that-does-not-exist");
+
+ assertEquals("hbase-thrift.example.com", DNS.getHostname(conf, DNS.ServerType.THRIFT));
+ }
+}
diff --git a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServer.java b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServer.java
index e72090f2295..38be5daf77f 100644
--- a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServer.java
+++ b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServer.java
@@ -46,8 +46,6 @@ import static org.apache.hadoop.hbase.thrift.Constants.PORT_CONF_KEY;
import static org.apache.hadoop.hbase.thrift.Constants.PORT_OPTION;
import static org.apache.hadoop.hbase.thrift.Constants.READ_TIMEOUT_OPTION;
import static org.apache.hadoop.hbase.thrift.Constants.SELECTOR_NUM_OPTION;
-import static org.apache.hadoop.hbase.thrift.Constants.THRIFT_DNS_INTERFACE_KEY;
-import static org.apache.hadoop.hbase.thrift.Constants.THRIFT_DNS_NAMESERVER_KEY;
import static org.apache.hadoop.hbase.thrift.Constants.THRIFT_FILTERS;
import static org.apache.hadoop.hbase.thrift.Constants.THRIFT_HTTP_ALLOW_OPTIONS_METHOD;
import static org.apache.hadoop.hbase.thrift.Constants.THRIFT_HTTP_ALLOW_OPTIONS_METHOD_DEFAULT;
@@ -108,7 +106,6 @@ import org.apache.hadoop.hbase.thrift.generated.Hbase;
import org.apache.hadoop.hbase.util.DNS;
import org.apache.hadoop.hbase.util.EnvironmentEdgeManager;
import org.apache.hadoop.hbase.util.JvmPauseMonitor;
-import org.apache.hadoop.hbase.util.Strings;
import org.apache.hadoop.hbase.util.VersionInfo;
import org.apache.hadoop.security.SaslRpcServer;
import org.apache.hadoop.security.UserGroupInformation;
@@ -207,9 +204,7 @@ public class ThriftServer extends Configured implements Tool {
securityEnabled =
userProvider.isHadoopSecurityEnabled() && userProvider.isHBaseSecurityEnabled();
if (securityEnabled) {
- host = Strings.domainNamePointerToHostName(
- DNS.getDefaultHost(conf.get(THRIFT_DNS_INTERFACE_KEY, "default"),
- conf.get(THRIFT_DNS_NAMESERVER_KEY, "default")));
+ host = DNS.getHostname(conf, DNS.ServerType.THRIFT);
userProvider.login(THRIFT_KEYTAB_FILE_KEY, THRIFT_KERBEROS_PRINCIPAL_KEY, host);
// Setup the SPNEGO user for HTTP if configured
diff --git a/hbase-website/app/pages/_docs/docs/_mdx/(multi-page)/security/client-access.mdx b/hbase-website/app/pages/_docs/docs/_mdx/(multi-page)/security/client-access.mdx
index 565187a18d2..8743f67d154 100644
--- a/hbase-website/app/pages/_docs/docs/_mdx/(multi-page)/security/client-access.mdx
+++ b/hbase-website/app/pages/_docs/docs/_mdx/(multi-page)/security/client-access.mdx
@@ -123,8 +123,21 @@ Add the following to the `hbase-site.xml` file for every Thrift gateway:
<name>hbase.thrift.dns.nameserver</name>
<value>default</value>
</property>
+<!-- Set this when the Thrift gateway is exposed through a service hostname
+ different from its DNS-discovered hostname. -->
+<property>
+ <name>hbase.unsafe.thrift.hostname</name>
+ <value>hbase-thrift.example.com</value>
+</property>
```
+When `hbase.unsafe.thrift.hostname` is set to a non-empty value, the Thrift gateway uses the
+configured value instead of the hostname discovered through `hbase.thrift.dns.interface` and
+`hbase.thrift.dns.nameserver`. The configured hostname is used for Kerberos `_HOST`
+substitution and as the SASL server hostname. This can be useful when multiple Thrift gateways
+are exposed through a common DNS name, VIP, or layer-4 load balancer. Each gateway using the
+common hostname must have a keytab containing the corresponding service principal.
+
Substitute the appropriate credential and keytab for _\$USER_ and _\$KEYTAB_ respectively.
In order to use the Thrift API principal to interact with HBase, it is also necessary to add the `hbase.thrift.kerberos.principal` to the `acl` table. For example, to give the Thrift API principal, `thrift_server`, administrative access, a command such as this one will suffice: