mirror of
https://github.com/apache/impala.git
synced 2025-12-19 18:12:08 -05:00
4592ed445e
Impala currently kinits by forking off a child process. This has proved to be expensive in many cases since the subprocess tries to reserve as much memory as Impala is currently using which can be quite a lot. This patch adds a flag called 'use_kudu_kinit' that defaults to true. When it's true, it uses the Kudu security library's kinit code that programatically uses the krb5 library to kinit. When it's false, we run our current path which kicks off the kinit-thread and forks off a kinit process periodically to reacquire tickets based on FLAGS_kerberos_reinit_interval. Converted existing tests in thrift-server-test to run with and without kerberos. We now run this BE test with kerberos by using Kudu's MiniKdc utility. This introduces a new dependency on some kerberos binaries that are checked through FindKerberosPrograms.cmake. Note that this is only a test dependency and not a dependency for the impalad binaries and friends. Compilation will still succeed if the kerberos binaries for the MiniKdc are not found, however, the thrift-server-test will fail. We run with and without the 'use_kudu_kinit' flag. TODO: Since the setting up and tearing down of our security code isn't idempotent, we can run only any one test in a process with Kerberos now (IMPALA-6085). Updated bin/bootstrap_system.sh to install new sasl-gssapi modules and the kerberos binaries required for the MiniKdc. Also fixed a bug that didn't transfer the environment into 'sudo' in bin/bootstrap_system.sh. Testing: Verified with thrift-server-test and also manually on a live kerberized cluster. Change-Id: I9cea56cc6e7412d87f4c2e92399a2f91ea6af6c7 Reviewed-on: http://gerrit.cloudera.org:8080/7938 Reviewed-by: Sailesh Mukil <sailesh@cloudera.com> Tested-by: Impala Public Jenkins
39 lines
1.5 KiB
CMake
39 lines
1.5 KiB
CMake
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# - Find Kerberos Binaries
|
|
# This module ensures that the Kerberos binaries depended on by tests are
|
|
# present on the system.
|
|
|
|
include(FindPackageHandleStandardArgs)
|
|
set(bins kadmin.local kdb5_util kdestroy kinit klist krb5kdc)
|
|
|
|
foreach(bin ${bins})
|
|
find_program(${bin} ${bin} PATHS
|
|
# Linux install location.
|
|
/usr/sbin
|
|
# Homebrew install location.
|
|
/usr/local/opt/krb5/sbin
|
|
# Macports install location.
|
|
/opt/local/sbin
|
|
# SLES
|
|
/usr/lib/mit/sbin)
|
|
endforeach(bin)
|
|
|
|
find_package_handle_standard_args(Kerberos REQUIRED_VARS ${bins}
|
|
FAIL_MESSAGE "Kerberos binaries not found: security tests will fail")
|