[Bug report] The Hive Catalog Bug In Multiple Kerberized HMS

[theoryxu]

Version

main branch

Describe what's wrong

precondition 1:

The form of hive.metastore.kerberos.principal should be like USER/[email protected], the instance of principal is a placeholder：_HOST

precondition 2:

When Gravitino HiveCatalogOperations initializes, the gravitinoConfig overwrites byPassConfig if possible, which means the kerberos.principal will overwrite the hive.metastore.kerberos.principal.

precondition 3:

the kerberos.principal's instance can not be a placeholder. Otherwise, the catalog can not log in under Kerberos.

conclusion:

In case an HMS has another instance (like in another host), the Gravitino's catalog doesn't work

possible solution

Increasing the priority of the gravitinoConfig. And Setting gravitino.bypass.hive.metastore.kerberos.principal in the right form.``

Error message and/or stacktrace

How to reproduce

step 1

Install gravitino in host1, Install HMS1 in host1, and install HMS2 in host2

step 2

create catalog1 for HMS1:

curl -L -X POST 'http://host1:8090/api/metalakes/mk1/catalogs'
-H 'Content-Type: application/json'
-H 'Accept: application/vnd.gravitino.v1+json'
--data-raw '{
"name": "catalog1",
"type": "relational",
"provider": "hive",
"properties": {
"metastore.uris": "thrift://host1:7004",
"kerberos.principal": "hadoop/[email protected]",
"kerberos.keytab-uri": "/var/krb5kdc/emr.keytab",
"gravitino.bypass.hadoop.security.authentication": "kerberos",
"gravitino.bypass.hive.metastore.sasl.enabled": true
}
}'

step 3

create catalog1 for HMS1:

curl -L -X POST 'http://host1:8090/api/metalakes/mk1/catalogs'
-H 'Content-Type: application/json'
-H 'Accept: application/vnd.gravitino.v1+json'
--data-raw '{
"name": "catalog2",
"type": "relational",
"provider": "hive",
"properties": {
"metastore.uris": "thrift://host2:7004",
"kerberos.principal": "hadoop/[email protected]",
"kerberos.keytab-uri": "/var/krb5kdc/emr.keytab",
"gravitino.bypass.hadoop.security.authentication": "kerberos",
"gravitino.bypass.hive.metastore.sasl.enabled": true
}
}'

step 4

curl -L -X GET 'http://host1:8090/api/metalakes/mk1/catalogs/catalog1/schemas'
success

curl -L -X GET 'http://host1:8090/api/metalakes/mk1/catalogs/catalog2/schemas'
failed

Additional context

No response

[jerryshao]

@qqqttt123 can you please take a look.

[qqqttt123]

I will take a look.

[qqqttt123]

@theoryxu Did you ever try gravitino.bypass.hive.metastore.kerberos.principal?

[theoryxu]

@theoryxu Did you ever try gravitino.bypass.hive.metastore.kerberos.principal?

I did try, but It did not work. the kerberos.principal will overwrite the hive.metastore.kerberos.principal.

[qqqttt123]

I misunderstand the meaning of METASTORE_KERBEROS_PRINCIPAL. Maybe we should remove PRINCIPAL -> METASTORE_KERBEROS_PRINCIPAL in the GRAVITINO_CONFIG_TO_HIVE.