[FLINK-9685] Flink should support hostname-substitution for security.kerberos.login.principal

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Component/s: Runtime / Coordination
• Labels: pull-request-available
• Assignee: Aleksandr Salatich
• Reporter: Ethan Li
• Created: 27/Jun/18 21:28
• Updated: 15/Jan/21 11:56
• Resolved: 15/Jan/21 11:54

Description

https://github.com/apache/flink/blob/master/flink-runtime/src/main/java/org/apache/flink/runtime/security/SecurityConfiguration.java#L83

 

We can have something like this

String rawPrincipal = flinkConf.getString(SecurityOptions.KERBEROS_LOGIN_PRINCIPAL);
if (rawPrincipal != null) {
   try {
      rawPrincipal = rawPrincipal.replace("HOSTNAME", InetAddress.getLocalHost().getCanonicalHostName());
   } catch (UnknownHostException e) {
      LOG.error("Failed to replace HOSTNAME with localhost because {}", e);
   }
}
this.principal = rawPrincipal;

So it will be easier to deploy flink to cluster. Instead of setting different principal on every node, we can have the same principal headless_user/HOSTNAME@DOMAIN .

Issue Links

• links to: GitHub Pull Request #7860