JiriOndrusek
commented
1 month ago I spent some time on this task. Here is the summary:
- the kerberos harness can not be used, (I was getting sime type of missing kinit)
- I used apache kerby as a kerberos server started by test resource. Everything is working as expected
- I can start kerberos server, create keytab files and krb5.conf
- I was able to configure the kudu containers to use kerby kerberos
- From the log, I can see that the master server started, tablet started, but then I see some negotiation errors (between tablet and master) I can not say what is wrong, interesting part is, that "random" principal is required in the kerberos, but is not found (The alphanumeric random string seems like container id or similar, but I haven't found what it represents. Once the origin of the id is known, I can create such principal in kerby)
2024-07-22 14:24:07,304 INFO [org.apa.cam.qua.com.kud.it.KuduTestResource] (docker-java-stream--1666742296) STDERR: W20240722 12:24:07.303607 512 heartbeater.cc:625] Failed to heartbeat to kudu-master:7051 (0 consecutive failures): Not authorized: Failed to ping master at kudu-master:7051: Client connection negotiation failed: client connection to 192.168.96.2:7051: Server krbtgt/80BEF488-1DFE-4A95-A33E-0C6EC61477DF@EXAMPLE.COM not found in Kerberos database
You can find my POC in the branch https://github.com/JiriOndrusek/camel-quarkus/tree/kudu-kerby-02 (There is a "workaround" with resolving hosting machine from the docker container, see class IpAddressHelper
Description
E.g configure the master with
--rpc_authentication=required. It may be tricky as it involves Kerberos.The main motivation here is for native mode. I am not sure if the kudu-client Kerberos auth will work OOTB. We had issues with Kerberos in native mode for other extensions (Kafka).