Hive Query Failed with Token Renewer Error | Hive on Spark

0 votes
0 views
asked Aug 20, 2017 in Hadoop by admin (4,410 points)
Summary
Symptoms
When running Hive on Spark query, it fails with below error:
2017-06-27 17:04:08,836 INFO org.apache.hive.spark.client.SparkClientImpl: [stderr-redir-1]: 17/06/27 17:04:08 
WARN security.UserGroupInformation: PriviledgedActionException as:testuser (auth:PROXY) via 
hive/example.hadoop.com@REALM.COM (auth:KERBEROS) cause:org.apache.hadoop.security.AccessControlException: 
testuser tries to renew a token with renewer hive
Applies To
  • Hive on Spark in Kerberos secured clusters.
Cause

This issue was introduced by an attempt to fix the upstream JIRA HIVE-14383.

Spark needs the principal/keytab passed in via --principal and --keytab options, and does the renewal by copying the keytab to the cluster and handling login to kerberos inside the application.  But the option --principal and --keytab could not work with --proxy-userin spark-submit.sh, so at this moment we could support either the token renewal or the impersonation, but not both.

Instructions
HIVE-14383 without the HIVE-15485 fix currently exists in following CDH releases:
CDH5.8.3, CDH5.8.4, CDH5.9.1, CDH5.10.0
HIVE-15485 has been fixed and is now available in the following CDH releases and above versions:
CDH5.8.5
CDH5.9.2
CDH5.10.1, CDH5.10.2
CDH5.11.0, CDH5.11.1
As there is no workaround for this failure, please upgrade or deploy to the latest maintenance version of the above mentioned releases to resolve this issue.

Please log in or register to answer this question.

...