[IMPALA-5129] Use Kudu's Kinit code to avoid expensive fork

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 2.11.0
• Component/s: Security
• Labels: security
• Epic Link: Avoid forking processes after startup
• Target Version: Impala 2.11.0
• Epic Color: ghx-label-3
• Assignee: Sailesh Mukil
• Reporter: Sailesh Mukil
• Created: 28/Mar/17 18:49
• Updated: 04/Apr/19 17:09
• Resolved: 30/Oct/17 16:44

Description

Impala does a kinit by doing a RunShell() command which basically forks the entire process (potentially expensive) and execs the 'kinit' command.

KuduRPC avoids the fork by calling into libkrb programatically. Since we eventually will be pulling in KuduRPC to Impala, we can get rid of the fork and call into the appropriate KuduRPC code.

Issue Links

• blocks: IMPALA-2294 Impalad unable to kinit after several days
• blocks: IMPALA-5893 Remove old kinit code for Impala 3
• contains: IMPALA-2655 Catalog throws NPE on kerberos re-logins -Possible race bug when Impala catalog does multiple failed kerberos re-logins to metastore
• duplicates: IMPALA-5804 Avoid expensive fork for kinit
• incorporates: IMPALA-4655 Add Kerberos minicluster test framework
• incorporates: IMPALA-743 Impala should use -l instead of -r with kinit
• supercedes: IMPALA-5385 Print appropriate error for failed TGT creation due to /tmp being full