大家好,
问题点:
1.cdh中kerberos已经被cm托管的情况下,cm中修改kerberos配置,/var/kerberos/krb5kdc/kdc.conf和/etc/krb5.conf都不变,好像是存在其他位置,这个有没有人清楚?
2.flink 1.8 on cdh5.14 yarn运行时,一天后报GSS initiate failed{caused by GSSException:No valid credentials provided}的报错,然后程序失败终止,怀疑是kerberos票据renew失效了,是不是我有哪里没配对,还是flink1.8还不支持renew?原先用spark-submit --keytab就会自动renew tgt
服务器端的相关部分配置:
1.flink-conf.yaml:
security.kerberos.login.use-ticket-cache: false
security.kerberos.login.keytab: /home/zjf/zjf.keytab
security.kerberos.login.contexts: Client,KafkaClient
zookeeper.sasl.service-name: zookeeper
zookeeper.sasl.login-context-name: Client
2./var/kerberos/krb5kdc/kdc.conf:
3./etc/krb5.conf:
其中的max_renewable_life是后面手动加的,kdc已重启过还是无效。
然后查看kerberos debug的日志, 发现有如下日志段:
Forwardable Ticket true
Forwarded Ticket false
Proxiable Ticket false
Proxy Ticket false
Postdated Ticket false
Renewable Ticket false
Initial Ticket false
Auth Time =Fri Apr 30 14:38:36 CST 2021
Start Time =Fri Apr 30 14:38:36 CST 2021
End Time =Sat May 01 14:38:36 CST 2021
Renew Till = null