Uploaded image for project: 'IMPALA'
  1. IMPALA
  2. IMPALA-9359

Recover gracefully from corrupt kerberos credential cache

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • Impala 3.3.0
    • Impala 3.4.0
    • Security
    • ghx-label-8

    Description

      1. Start up a kerberized Impala cluster
      2. Corrupt the kerberos ticket cache used by impala /tmp/krb5cc_impala_internal
      3. Observe queries fail. The details depend a lot on timing, etc. I have seen communication failures between impalads and with other systems, e.g. HDFS.
      4. The system will stay wedge in this state indefinitely

      We have seen this happen once in production from /tmp filling up.

      I prototyped a fix that amounts to re-running Kinit() to blow away the broken credential cache. It needs more work to be production-ready

      Attachments

        Issue Links

          Activity

            People

              tarmstrong Tim Armstrong
              tarmstrong Tim Armstrong
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: