Details
Description
Starting the KMS service without first running `kinit` fails when using HDFS to store the keys, throwing:
java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
with the following underlying cause:
Caused by: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS] at org.apache.hadoop.security.SaslRpcClient.selectSaslClient(SaslRpcClient.java:179) at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:392)
In addition, it would be valuable to have the automatic refresh using the keytab which is provided by the UserGroupInformation.
I'm proposing 2 new configuration settings to allow the definition of the principal and keytab to use for KMS, and if provided that they should be initialized as part of the server startup using the UserGroupInformation methods to support reloading.