hadoop - 使用 Ooize 时为 TableMapReduceUtil 重置 Kerberos 登录上下文

Question

我尝试在受 Kerberos 保护的 CDH 集群上运行 mapreduce 作业。该作业从 hdfs(mapper) 读取文件并写入 hbase 表 (reducer/TableMapReduceUtil) 类。

我做的作业配置是，

Configuration hbaseConfigurarion =  HBaseConfiguration.create();            
hbaseConfigurarion.set("hbase.zookeeper.quorum", args[1]);
hbaseConfigurarion.set("hbase.zookeeper.property.clientPort", "2181");
hbaseConfigurarion.set("hadoop.security.authentication", "kerberos");
hbaseConfigurarion.set("hbase.security.authentication", "kerberos");
hbaseConfigurarion.addResource(new Path("/etc/hadoop/conf/core-site.xml"));
hbaseConfigurarion.addResource(new Path("/etc/hadoop/conf/hdfs-site.xml"));
hbaseConfigurarion.addResource(new Path("/etc/hadoop/conf/yarn-site.xml"));
hbaseConfigurarion.addResource(new Path("/etc/hadoop/conf/mapred-site.xml"));
hbaseConfigurarion.addResource(new Path("/etc/hbase/conf/hbase-site.xml"));
hbaseConfigurarion.addResource(new Path("/etc/oozie/conf/oozie-site.xml"));

Job job = new Job(hbaseConfigurarion, "hdfs_hbase_test");
job.setJarByClass(HdfsHbaseTestDriver.class);

job.setInputFormatClass(TextInputFormat.class);
TextInputFormat.addInputPath(job, new Path(args[0]));

job.setOutputFormatClass(TableOutputFormat.class);
TableMapReduceUtil.initTableReducerJob(args[2], null , job);

当我使用“hadoop jar”命令运行此 mapreduce 作业时，它会自动执行 kerberos 身份验证，并使用存储在缓存中的有效和更新的 TGT 票证。考虑这里的用户名主体是 MY_ID@COMPANY。 COM.

但是，当我使用 oozie workflow 运行此作业时，它会失败，并出现来自 TableMapReduceUtil.initTableReducerJob() 行的以下异常。

2014-09-25 20:19:21,611 WARN [main] org.apache.hadoop.security.UserGroupInformation: PriviledgedActionException as:MY_ID (auth:SIMPLE) cause:javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]

2014-09-25 20:19:21,612 WARN [main] org.apache.hadoop.ipc.RpcClient: Exception encountered while connecting to the server : javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
2014-09-25 20:19:21,613 FATAL [main] org.apache.hadoop.ipc.RpcClient: SASL authentication failed. The most likely cause is missing or invalid credentials. Consider 'kinit'.
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)
at org.apache.hadoop.hbase.security.HBaseSaslRpcClient.saslConnect(HBaseSaslRpcClient.java:136)
at org.apache.hadoop.hbase.ipc.RpcClient$Connection.setupSaslConnection(RpcClient.java:762)
at org.apache.hadoop.hbase.ipc.RpcClient$Connection.access$600(RpcClient.java:354)
at org.apache.hadoop.hbase.ipc.RpcClient$Connection$2.run(RpcClient.java:883)
at org.apache.hadoop.hbase.ipc.RpcClient$Connection$2.run(RpcClient.java:880)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:415)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
at org.apache.hadoop.hbase.ipc.RpcClient$Connection.setupIOstreams(RpcClient.java:880)
at org.apache.hadoop.hbase.ipc.RpcClient.getConnection(RpcClient.java:1535)
at org.apache.hadoop.hbase.ipc.RpcClient.call(RpcClient.java:1424)
.
.
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:121)
at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187)
at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:223)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:193)

我真的不确定为什么当使用 oozie 工作流运行时执行 TableMapReduceUtil.initTableReducerJob() 行时登录的用户名 MY_ID@COMPANY.COM 变成了 MY_ID 并且 KERBEROS 身份验证方法变得简单..

是否还有我缺少的配置....请建议....

Answer 1

添加 TableMapReduceUtil.initCredentials(job);