[Bug] Kyuubi has no permission to access the kudu metadata table after integrating Ranger
- Dominant language
- Scala
- Stars
- 2.4k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
**ENV**
have kyuubi (1.7),spark(3.2) ,ranger(2.4.0)
**problems:**
when create temporary view using kudu, found user change to yarn and permission denied.
**operations**
(1) select * from test.impala_log order by event_time desc limit 30;
i query some data from hdfs with user(root),everything is fine, and i found my user is root from ranger like:

(2) CREATE or REPLACE TEMPORARY VIEW test_view_kudu USING kudu options (kudu.master "***", kudu.table "test__verify");
i create temporary view using kudu table,i got permission denied, I found the user change to yarn from ranger

(3) and run the (2) same sql in spark-sql, i got no error, and i found the user still root(the user execute the sparksql script) from ranger

### Affects Version(s)
master 1.7
### Kyuubi Server Log Output
_No response_
### Kyuubi Engine Log Output
_No response_
### Kyuubi Server Configurations
_No response_
### Kyuubi Engine Configurations
_No response_
### Additional context
_No response_
### Are you willing to submit PR?
- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [x] No. I cannot submit a PR at this time.
Contributor guide
Research direction
Reproduce the two SQL operations described in the issue with Kyuubi, Spark 3.2, Ranger 2.4.0, and Kudu, then compare them with the successful spark-sql execution. The report includes no server or engine logs and no configurations, so collect those while tracing why the effective user changes to yarn; done means the Kudu metadata access uses the expected user and succeeds under the same permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala, spark
- Domain
- authorization, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100