[AMBARI-15324] Kerberos Tickets Expire Too Frequently For Alerts

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.2.2
• Component/s: ambari-agent
• Assignee: Jonathan Hurley
• Reporter: Jonathan Hurley
• Created: 07/Mar/16 22:35
• Updated: 08/Mar/16 23:39
• Resolved: 08/Mar/16 20:57

Description

When a cluster has been Kerberized, alerts use the curl_krb_request module in order to make requests using SPNEGO negotiation.

Normally this would involve calling kinit and then invoking the curl command to use the acquired ticket. However, because alerts run often on fixed intervals, this would mean that the KDC would be flooded with requests every minute.

To alleviate this problem, curl_krb_request uses klist to inspect the KRB5CCNAME cache. Only if an invalid ticket is found is kinit invoked. Additionally, kinit is invoked with a fixed ticket lifetime of 5 minutes. Since many alerts run on 5-minute intervals, this causes boundary issues.

To workaround these problems while continuing to leverage the cache, curl_krb_request should be changed to:

• Use the default ticket expiry configured for Kerberos in krb5.conf
• Employ in-memory tracking of the last time kinit was called so that it can be invoked before hitting the boundary of the ticket's expiration time

Issue Links

• links to: Reviewboard