-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* hdfs support krb5 * update libhdfs3 to support krb5 * hdfs support keberos auth * update ppc_builder * fix centos ci * add more logs * fix hdfs auth bug * support specify the krb5.conf * fix centos ci
- Loading branch information
1 parent
0c714dd
commit 3def5dd
Showing
33 changed files
with
689 additions
and
74 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| /* | ||
| * Copyright (C) 2022 WeDPR. | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| * @file Krb5AuthConfig.h | ||
| * @author: yujiechen | ||
| * @date 2024-12-2 | ||
| */ | ||
| #pragma once | ||
| #include "ppc-framework/Common.h" | ||
| #include <memory> | ||
| #include <sstream> | ||
| #include <string> | ||
|
|
||
| namespace ppc::protocol | ||
| { | ||
| struct Krb5AuthConfig | ||
| { | ||
| using Ptr = std::shared_ptr<Krb5AuthConfig>; | ||
| std::string principal; | ||
| std::string password; | ||
| std::string ccachePath; | ||
| std::string authConfigFilePath = "./conf/krb5.conf"; | ||
| void check() const | ||
| { | ||
| if (principal.size() == 0) | ||
| { | ||
| BOOST_THROW_EXCEPTION(WeDPRException() << bcos::errinfo_comment( | ||
| "Invalid krb5 auth config: Must set the principal!")); | ||
| } | ||
| if (password.size() == 0) | ||
| { | ||
| BOOST_THROW_EXCEPTION(WeDPRException() << bcos::errinfo_comment( | ||
| "Invalid krb5 auth config: Must set the password!")); | ||
| } | ||
| if (ccachePath.size() == 0) | ||
| { | ||
| BOOST_THROW_EXCEPTION(WeDPRException() << bcos::errinfo_comment( | ||
| "Invalid krb5 auth config: Must set the ccachePath!")); | ||
| } | ||
| if (authConfigFilePath.size() == 0) | ||
| { | ||
| BOOST_THROW_EXCEPTION( | ||
| WeDPRException() << bcos::errinfo_comment( | ||
| "Invalid krb5 auth config: Must set the authConfigFilePath!")); | ||
| } | ||
| } | ||
|
|
||
| inline std::string desc() const | ||
| { | ||
| std::stringstream oss; | ||
| oss << LOG_KV("principal", principal) << LOG_KV("ccachePath", ccachePath) | ||
| << LOG_KV("authConfigFilePath", authConfigFilePath); | ||
| return oss.str(); | ||
| } | ||
| }; | ||
| } // namespace ppc::protocol |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -476,14 +476,24 @@ generate_node_config_ini() { | |
| [hdfs_storage] | ||
| ; the hdfs configuration | ||
| user = app | ||
| user = root | ||
| name_node = 127.0.0.1 | ||
| name_node_port = 9000 | ||
| token = | ||
| ; enable replace-datanode-on-failure or not | ||
| replace-datanode-on-failure = false | ||
| ; the connection-timeout, in ms, default is 1000ms | ||
| connection-timeout = 1000 | ||
| ; enable auth or not, default is false | ||
| ; enable_krb5_auth = false | ||
| ; the hdfs kerberos auth principal, used when enable_krb5_auth | ||
| ; auth_principal = [email protected] | ||
| ; the hdfs kerberos auth password, used when enable_krb5_auth | ||
| ; auth_password = | ||
| ; the ccache path, used when enable_krb5_auth | ||
| ; ccache_path = /tmp/krb5cc_ppc_node | ||
| ; the krb5.conf path | ||
| ; krb5_conf_path = conf/krb5.conf | ||
| [ra2018psi] | ||
|
|
@@ -541,6 +551,31 @@ generate_node_config_ini() { | |
| EOF | ||
| } | ||
|
|
||
| generate_krb5_file_template() | ||
| { | ||
| local filepath=$1 | ||
| mkdir -p $(dirname $filepath) | ||
| cat << EOF > "${filepath}" | ||
| [libdefaults] | ||
| default_realm = NODE.DC1.CONSUL | ||
| dns_lookup_realm = false | ||
| dns_lookup_kdc = false | ||
| ticket_lifetime = 24h | ||
| renew_lifetime = 7d | ||
| forwardable = true | ||
| [realms] | ||
| NODE.DC1.CONSUL = { | ||
| kdc = | ||
| admin_server = | ||
| } | ||
| [domain_realm] | ||
| .node.dc1.consul = NODE.DC1.CONSUL | ||
| node.dc1.consul = NODE.DC1.CONSUL | ||
| EOF | ||
| } | ||
|
|
||
| generate_script_template() | ||
| { | ||
| local filepath=$1 | ||
|
|
@@ -915,6 +950,7 @@ deploy_nodes() | |
| private_key=$(generate_private_key "${node_dir}/conf") | ||
| node_id=$(cat "${node_dir}/conf/node.nodeid") | ||
| generate_node_config_ini "${node_dir}/config.ini" "${listen_ip}" "${gateway_port}" "${listen_ip}" "${rpc_port}" "${listen_ip}" "${grpc_port}" ${agency_id} "${count}" "${node_id}" | ||
| generate_krb5_file_template "${node_dir}/conf/krb5.conf" | ||
| generate_p2p_connected_conf "${node_dir}/${p2p_connected_conf_name}" "${connected_nodes}" "false" | ||
| set_value ${ip//./}_count $(($(get_value ${ip//./}_count) + 1)) | ||
| ((++count)) | ||
|
|
||
Oops, something went wrong.