apache / apache/kyuubi

[Bug] Kyuubi has no permission to access the kudu metadata table after integrating Ranger

Open
#5,067 1 comment 0 reactions 0 assignees View on GitHub
kind:bug priority:major
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

**ENV**
have kyuubi (1.7),spark(3.2) ,ranger(2.4.0)

**problems:**
when create temporary view using kudu, found user change to yarn and permission denied.

**operations**

(1) select * from test.impala_log order by event_time desc limit 30;
i query some data from hdfs with user(root),everything is fine, and i found my user is root from ranger like:
![image](https://github.com/apache/kyuubi/assets/46547576/9662c0eb-3ae4-46ac-9b8d-4cf9e72f22e8)

(2) CREATE or REPLACE TEMPORARY VIEW test_view_kudu USING kudu options (kudu.master "***", kudu.table "test__verify");
i create temporary view using kudu table,i got permission denied, I found the user change to yarn from ranger
![image](https://github.com/apache/kyuubi/assets/46547576/44748f40-7265-4853-a67f-4618cea8cf76)

(3) and run the (2) same sql in spark-sql, i got no error, and i found the user still root(the user execute the sparksql script) from ranger

![image](https://github.com/apache/kyuubi/assets/46547576/076a89a7-5bb1-477a-b847-e0e00b3045ff)

### Affects Version(s)

master 1.7

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

_No response_

### Kyuubi Engine Configurations

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [x] No. I cannot submit a PR at this time.

Contributor guide

Open the contributing guide

Research direction

Reproduce the two SQL operations described in the issue with Kyuubi, Spark 3.2, Ranger 2.4.0, and Kudu, then compare them with the successful spark-sql execution. The report includes no server or engine logs and no configurations, so collect those while tracing why the effective user changes to yarn; done means the Kudu metadata access uses the expected user and succeeds under the same permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala, spark
Domain
authorization, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.