Abhishek Chennaka created KUDU-3771:
---------------------------------------
Summary: Kerberos issue with kudu master add tool
Key: KUDU-3771
URL: https://issues.apache.org/jira/browse/KUDU-3771
Project: Kudu
Issue Type: Bug
Reporter: Abhishek Chennaka
Came across the below issue in the field and wanted to document it:
Running kudu master add CLI tool in a kerberized cluster in-spite of having
valid credentials can sometime lead to kerberos related error like below:
# sudo -u kudu kinit
# sudo -u kudu kudu master add master1,master2 master3
--fs_wal_dir=/data/01/kudu/master/wal
--fs_data_dirs=/data/01/kudu/master/data,/data/02/kudu/master/data,/data/03/kudu/master/data
Remote error: Not authorized: Client connection negotiation failed: client
connection to master3:7051: client requires authentication, but server does not
have Kerberos enabled.
Workaround followed was to add additional flags:
# sudo -u kudu kinit
# sudo -u kudu kudu master add master1,master2 master3
--fs_wal_dir=/data/01/kudu/master/wal
--fs_data_dirs=/data/01/kudu/master/data,/data/02/kudu/master/data,/data/03/kudu/master/data
\
--rpc_authentication=required \
--rpc_encryption=required \
--webserver_require_spnego=true \
--keytab_file=<path to kudu.keytab> \
--principal=<corresponding principal> \
--webserver_certificate_file=<path to cert.pem> \
--webserver_private_key_file=<path to cert.key>
Few of the above flags are not needed but couldn't reproduce the issue to
verify the exact flags needed or the root cause.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
