[RANGER-3989] KMS APIs fail due to ConcurrentModificationException

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.4.0
• Component/s: kms
• Assignee: Madhan Neethiraj
• Reporter: Madhan Neethiraj
• Created: 28/Nov/22 03:12
• Updated: 19/Mar/24 10:27
• Resolved: 17/Jan/23 00:17

Description

When KMS APIs are called concurrently they can fail with  ConcurrentModificationException, due to updates to a map instance while another thread is in the middle of iterating the map - for example:

java.util.ConcurrentModificationException: null
        at java.util.HashMap$HashIterator.nextNode(HashMap.java:1469)
        at java.util.HashMap$EntryIterator.next(HashMap.java:1503)
        at java.util.HashMap$EntryIterator.next(HashMap.java:1501)
        at org.apache.hadoop.crypto.key.RangerKeyStoreProvider.flush(RangerKeyStoreProvider.java:360)
        at org.apache.hadoop.crypto.key.KeyProviderExtension.flush(KeyProviderExtension.java:127)
        at org.apache.hadoop.crypto.key.KeyProviderExtension.flush(KeyProviderExtension.java:127)
        at org.apache.hadoop.crypto.key.KeyProviderExtension.flush(KeyProviderExtension.java:127)
        at org.apache.hadoop.crypto.key.kms.server.KeyAuthorizationKeyProvider.flush(KeyAuthorizationKeyProvider.java:365)
        at org.apache.hadoop.crypto.key.kms.server.KMS$1.run(KMS.java:159)
        at org.apache.hadoop.crypto.key.kms.server.KMS$1.run(KMS.java:155)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Subject.java:422)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1845)
        at org.apache.hadoop.crypto.key.kms.server.KMS.createKey(KMS.java:154) 

Issue Links

• is related to: HADOOP-19118 KeyShell fails with NPE when KMS throws Exception with null as message