Adding troubleshooting for kerberos #702
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sbernauer
requested changes
Oct 21, 2025
| @@ -0,0 +1,18 @@ | |||
| = Troubleshooting | |||
|
|
|||
| == Hbase access with kerberos authentication | |||
There was a problem hiding this comment.
Suggested change
| == Hbase access with kerberos authentication | |
| == HBase access with Kerberos authentication |
|
|
||
| == Hbase access with kerberos authentication | ||
|
|
||
| Currently, xref:zookeeper:index.adoc[Zookeeper] is not secured with authentication. This means, if an application tries to connect to Hbase, it would ask the zookeeper quorum to figure the correct nodes to talk to. In a Java world, you would define a `Client` which would carry the kerberos requirements. |
There was a problem hiding this comment.
Pls separate sentences with newlines (in docs)
Suggested change
| Currently, xref:zookeeper:index.adoc[Zookeeper] is not secured with authentication. This means, if an application tries to connect to Hbase, it would ask the zookeeper quorum to figure the correct nodes to talk to. In a Java world, you would define a `Client` which would carry the kerberos requirements. | |
| Currently, xref:zookeeper:index.adoc[Zookeeper] stacklets can only be secured using mutual TLS. | |
| This means, if an application tries to connect to HBase, it would contact Zookeeper to figure the correct HBase nodes to talk to. | |
| In a Java world, you would define a `Client` which would carry the Kerberos requirements. |
|
|
||
| Currently, xref:zookeeper:index.adoc[Zookeeper] is not secured with authentication. This means, if an application tries to connect to Hbase, it would ask the zookeeper quorum to figure the correct nodes to talk to. In a Java world, you would define a `Client` which would carry the kerberos requirements. | ||
|
|
||
| However, those requirements might be passed through and thus your client ( e.g. xref:spark-k8s:usage-guide:operations:applications.adoc[SparkApplications] ) would try to authenticate with kerberos at the corresponding Zookeeper endpoint. This will result in a kerberos ( authentication ) error. |
There was a problem hiding this comment.
Suggested change
| However, those requirements might be passed through and thus your client ( e.g. xref:spark-k8s:usage-guide:operations:applications.adoc[SparkApplications] ) would try to authenticate with kerberos at the corresponding Zookeeper endpoint. This will result in a kerberos ( authentication ) error. | |
| However, those requirements might be passed through and thus your client (e.g. xref:spark-k8s:usage-guide:operations:applications.adoc[SparkApplications]) would try to authenticate with Kerberos at the corresponding Zookeeper endpoint. | |
| This will result in a Kerberos ( authentication ) error. |
|
|
||
| However, those requirements might be passed through and thus your client ( e.g. xref:spark-k8s:usage-guide:operations:applications.adoc[SparkApplications] ) would try to authenticate with kerberos at the corresponding Zookeeper endpoint. This will result in a kerberos ( authentication ) error. | ||
|
|
||
| To prevent this, you can set a jvm argument like ( again e.g. SparkApplications ) |
There was a problem hiding this comment.
Suggested change
| To prevent this, you can set a jvm argument like ( again e.g. SparkApplications ) | |
| To prevent this, you can set a JVM argument like this (again e.g. SparkApplications) in all Pods which would like to talk to HBase: |
Comment on lines
+13
to
+15
| jvmArgumentOverrides: | ||
| add: | ||
| - "-Dzookeeper.sasl.client=false" |
There was a problem hiding this comment.
AFAIK we normally use 2 spaces
Suggested change
| jvmArgumentOverrides: | |
| add: | |
| - "-Dzookeeper.sasl.client=false" | |
| jvmArgumentOverrides: | |
| add: | |
| - "-Dzookeeper.sasl.client=false" |
Comment on lines
+17
to
+18
|
|
||
| in all pods which would like to talk to Hbase. |
There was a problem hiding this comment.
Suggested change
| in all pods which would like to talk to Hbase. |
|
|
||
| However, those requirements might be passed through and thus your client ( e.g. xref:spark-k8s:usage-guide:operations:applications.adoc[SparkApplications] ) would try to authenticate with kerberos at the corresponding Zookeeper endpoint. This will result in a kerberos ( authentication ) error. | ||
|
|
||
| To prevent this, you can set a jvm argument like ( again e.g. SparkApplications ) |
There was a problem hiding this comment.
Can you please link to https://docs.stackable.tech/home/stable/concepts/overrides/#jvm-argument-overrides?
Please make sure the docs still build afterwards (you need to build the documentation repo locally for that)
sbernauer
moved this from Development: Waiting for Review
to Development: In Review
in Stackable Engineering
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Adds brief docs on troubleshooting kerberos auth in hbase.
Definition of Done Checklist
Author
Reviewer
Acceptance
type/deprecationlabel & add to the deprecation scheduletype/experimentallabel & add to the experimental features tracker