Doris2.0 连接 开启 Kerberos 中的 HDFS 失败。

[xiaofsu]

Doris:2.0 CDH:6.3.1，已开启 Kerberos 认证。

使用 doris 命令时：

CREATE REPOSITORY `hdfs_repo`
WITH hdfs
ON LOCATION "hdfs://hadoop-name-node:54310/path/to/repo/"
PROPERTIES
(
    "fs.defaultFS" = "hdfs://hadoop-name-node:54310",
    "hadoop.security.authentication" = "Kerberos",
    "hadoop.kerberos.principal" = "hdfs/[email protected]",
    "hadoop.kerberos.keytab" = "/path/to/hdfs.keytab"
);

提示：

 org.apache.doris.common.DdlException: errCode = 2, detailMessage = Failed to create repository: errors while get file status DestHost:destPort worker-3:8020 , LocalHost:localPort localhost.localdomain/127.0.0.1:0. Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
        at org.apache.doris.common.ErrorReport.reportDdlException(ErrorReport.java:68) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.common.ErrorReport.reportDdlException(ErrorReport.java:63) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.backup.BackupHandler.createRepository(BackupHandler.java:220) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.DdlExecutor.execute(DdlExecutor.java:228) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.StmtExecutor.handleDdlStmt(StmtExecutor.java:2246) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.StmtExecutor.executeByLegacy(StmtExecutor.java:783) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.StmtExecutor.execute(StmtExecutor.java:478) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.StmtExecutor.execute(StmtExecutor.java:443) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.ConnectProcessor.handleQuery(ConnectProcessor.java:435) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.ConnectProcessor.dispatch(ConnectProcessor.java:584) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.qe.ConnectProcessor.processOnce(ConnectProcessor.java:841) ~[doris-fe.jar:1.2-SNAPSHOT]
        at org.apache.doris.mysql.ReadListener.lambda$handleEvent$0(ReadListener.java:52) ~[doris-fe.jar:1.2-SNAPSHOT]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_291]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_291]
        at java.lang.Thread.run(Thread.java:748) ~[?:1.8.0_291]

已经确认的信息有：
1：keytab 文件是有效的
2：principal 和 keytab 是对应的
3：两台机器的时间是同步的
4：两台机器互相访问是没问题的

现在在 cdh 中看不到 kerberos 关于认证的错误，只能看到 doris 里的认证错误。

求大佬给解决方案。

[xiaofsu]

解决了，不需要在 properties 中指定 fs.defaultFS 就可以了：

CREATE REPOSITORY `hdfs_repo`
WITH hdfs
ON LOCATION "hdfs://hadoop-name-node:54310/path/to/repo/"
PROPERTIES
(
    "hadoop.security.authentication" = "Kerberos",
    "hadoop.kerberos.principal" = "hdfs/[email protected]",
    "hadoop.kerberos.keytab" = "/path/to/hdfs.keytab"
);