[HDDS-2881] Legacy (isolated) ozonefs couldn't work in secure environments

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Duplicate
• Labels: Triaged
• Target Version/s: 1.0.0
• Assignee: Marton Elek
• Reporter: Marton Elek
• Created: 13/Jan/20 09:58
• Updated: 03/Jun/20 10:46
• Resolved: 03/Jun/20 10:46

Description

The unsecure ozonefs is tested together with different version of Hadoop (2.7, 3.1, 3.2). The "legacy" (isolated) ozonefs package makes it possible to use it together with older Hadoop versions.

But the ozonesecure-mr (testing ozonefs with mapreduce in secure Ozone environment) is executed only with Hadoop 3.2 (which uses the "current" (shared) ozonefs instead of the "legacy" (isolated))

It turned on that the "legacy" ozonefs couldn't work in secure environment which means Ozone can be used only together with Hadoop 3.2 if the Hadoop/Ozone environment is secure

There are multiple problems. The first visible one is the following (run cd compose/ozonesecure-mr && ./test.sh after s/current/legacy/ in docker-config/docker-compose.yaml):

2020-01-13 10:03:39 ERROR OzoneClientFactory:193 - Couldn't create RpcClient protocol exception: 
java.io.IOException: DestHost:destPort om:9862 , LocalHost:localPort rm/172.21.0.10:0. Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
	at sun.reflect.GeneratedConstructorAccessor2.newInstance(Unknown Source)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at org.apache.hadoop.net.NetUtils.wrapWithMessage(NetUtils.java:831)
	at org.apache.hadoop.net.NetUtils.wrapException(NetUtils.java:806)
	at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1515)
	at org.apache.hadoop.ipc.Client.call(Client.java:1457)
	at org.apache.hadoop.ipc.Client.call(Client.java:1367)
	at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:228)
	at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:116)
	at com.sun.proxy.$Proxy13.submitRequest(Unknown Source)
	at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:422)
	at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:165)
	at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:157)
	at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:95)
	at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:359)
	at com.sun.proxy.$Proxy13.submitRequest(Unknown Source)
	at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.submitRequest(OzoneManagerProtocolClientSideTranslatorPB.java:394)
	at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.getServiceInfo(OzoneManagerProtocolClientSideTranslatorPB.java:1283)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.hadoop.hdds.tracing.TraceAllMethod.invoke(TraceAllMethod.java:71) 

Issue Links

• is superceded by: HDDS-3458 Support Hadoop 2.x with build-time classpath separation instead of isolated classloader