We're updating the issue view to help you get more done. 

Hive ATSHook fails to execute in Secure Hadoop clusters

Description

When we execute explore query in a secure Hadoop cluster on HDP 2.6.x, it fails with the following exception. This is because HDP 2.6.x has Hive ATSHook enabled by default, and CDAP Master does not pass the delegation token from the Timeline server to the Explore container.

Release Notes

Fixed CDAP to work with and publish to Yarn Timeline Server in a secure environment.

Activity

Show:
Ali Anwar
July 26, 2017, 8:07 PM
Edited

To disable the ATKHook, set the value for the following three configurations to a single space ' '.

Edit: This didn't seem to fix the issue. After we set 'yarn.timeline-service.enabled' to false, then we were able to avoid this issue in a Kerberos-enabled environment.

Ali Anwar
July 26, 2017, 11:10 PM

With ATSHook enabled (default in Ambari 2.6+), I see the following in the explore logs:

Ali Anwar
August 21, 2017, 8:56 PM

Updated to also acquire delegation tokens for Yarn TimelineServer: https://github.com/caskdata/cdap/pull/9432

Assignee

Ali Anwar

Reporter

Poorna Chandra

Labels

Docs Impact

None

UX Impact

None

Components

Fix versions

Affects versions

Priority

Major
Configure