[HDDS-7529] Secure SCM bootstrap fails if clusterID validation is disabled

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 1.3.0
• Component/s: SCM HA
• Target Version/s: 1.4.0
• Assignee: Aryan Gupta
• Reporter: Attila Doroszlai
• Created: 22/Nov/22 18:08
• Updated: 25/Aug/23 07:57
• Resolved: 25/Aug/23 07:57

Description

Secure SCM bootstrap fails if ozone.scm.skip.bootstrap.validation=true.

org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[KERBEROS]
  ...
  at org.apache.hadoop.hdds.protocolPB.SCMSecurityProtocolClientSideTranslatorPB.getSCMCertChain(SCMSecurityProtocolClientSideTranslatorPB.java:222)
  at org.apache.hadoop.hdds.scm.ha.HASecurityUtils.getRootCASignedSCMCert(HASecurityUtils.java:150)
  at org.apache.hadoop.hdds.scm.ha.HASecurityUtils.initializeSecurity(HASecurityUtils.java:103)
  at org.apache.hadoop.hdds.scm.server.StorageContainerManager.initializeSecurityIfNeeded(StorageContainerManager.java:1157)
  at org.apache.hadoop.hdds.scm.server.StorageContainerManager.scmBootstrap(StorageContainerManager.java:1084)
  at org.apache.hadoop.hdds.scm.server.StorageContainerManagerStarter$SCMStarterHelper.bootStrap(StorageContainerManagerStarter.java:192)
  at org.apache.hadoop.hdds.scm.server.StorageContainerManagerStarter.bootStrapScm(StorageContainerManagerStarter.java:135)