[AMBARI-15645] Upgrading Kerberized JournalNode requires HDFS principal to perform 'role edits' task

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.2
• Fix Version/s: 2.2.2
• Component/s: ambari-server
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 31/Mar/16 13:23
• Updated: 01/Apr/16 13:31
• Resolved: 01/Apr/16 13:31

Description

After upgrading HDP in Ambari version 2.1.2.1 a task a performed to role edits while restarting JournalNodes. If Kerberos is enabled, the JN Kerberos identity is established before making this call when really the HDFS identity should be established - since this is an administrative HDFS call that requires the HDFS administrator user to perform.

Because of this, the following error is generated and seen in the :

Fail: Execution of 'hdfs dfsadmin -rollEdits' returned 255. rollEdits: Access denied for user jn. Superuser privilege is required

The offending code is

common-services/HDFS/2.1.0.2.0/package/scripts/journalnode_upgrade.py

  if params.security_enabled:
    Execute(params.jn_kinit_cmd, user=params.hdfs_user)

  time.sleep(5)
  hdfs_roll_edits()
  time.sleep(5)

It should probably be something like:

common-services/HDFS/2.1.0.2.0/package/scripts/journalnode_upgrade.py

  if params.security_enabled:
    Execute(params.hdfs_kinit_cmd, user=params.hdfs_user)

  time.sleep(5)
  hdfs_roll_edits()
  time.sleep(5)

Note the change from jn to hdfs in the kinit command line.

This issue has also been posted in https://issues.apache.org/jira/browse/AMBARI-10519.

Issue Links

• duplicates: AMBARI-10519 Ambari 2.0 stack upgrade HDP 2.2.0.0 => 2.2.4.0 breaks on HDFS HA JournalNode rollEdits: "Access denied for user jn. Superuser privilege is required"
• links to: ReviewBoard