Add Kerberos test case in CI

.travis.yml

@@ -1,10 +1,14 @@
 sudo: required
 
 env:
-  - USE_MINIKUBE_DRIVER_NONE=true USE_SUDO_MINIKUBE=true
+  - CASES=_basic.sh
+  - CASES=_kerberos.sh
 
 before_script:
-- tests/setup.sh
+# Required for K8s v1.10.x. See
+# https://github.com/kubernetes/kubernetes/issues/61058#issuecomment-372764783
+- sudo mount --make-shared / && sudo service docker restart
+- USE_MINIKUBE_DRIVER_NONE=true USE_SUDO_MINIKUBE=true tests/setup.sh
 
 script:
 - tests/run.sh

charts/hdfs-client/Chart.yaml

@@ -1,17 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+apiVersion: v1
 name: hdfs-client-k8s
-version: 0.2
+version: 0.2.0
 description: Hadoop Distributed File System (HDFS) hosted by Kubernetes.

charts/hdfs-datanode-k8s/Chart.yaml

@@ -1,17 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+apiVersion: v1
 name: hdfs-datanode-k8s
-version: 0.2
+version: 0.2.0
 description: Hadoop Distributed File System (HDFS) hosted by Kubernetes.

charts/hdfs-datanode-k8s/README.md

@@ -25,7 +25,9 @@ HDFS `datanodes` running inside a kubernetes cluster. See the other chart for
      If enabling Kerberos, specify necessary options. For instance,
      ```
      $ helm install -n my-hdfs-datanode  \
-         --set kerberosEnabled=true,kerberosRealm=MYCOMPANY.COM hdfs-datanode-k8s
+         --set kerberosEnabled=true  \
+         --set kerberosRealm=MYCOMPANY.COM  \
+         hdfs-datanode-k8s
      ```
      The two variables above are required. For other variables, see values.yaml.
      If you have launched the non-HA namenode using

charts/hdfs-datanode-k8s/templates/datanode-daemonset.yaml

@@ -48,9 +48,9 @@ spec:
             - name: HDFS_CONF_dfs_datanode_kerberos_principal
               value: hdfs/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             - name:  HDFS_CONF_dfs_datanode_kerberos_https_principal
-              value: http/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             - name: HDFS_CONF_dfs_web_authentication_kerberos_principal
-              value: http/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             - name: HDFS_CONF_dfs_datanode_keytab_file
               value: /etc/security/hdfs.keytab
             {{- if .Values.jsvcEnabled }}

charts/hdfs-journalnode-k8s/Chart.yaml

@@ -1,17 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+apiVersion: v1
 name: hdfs-journalnode-k8s
-version: 0.2
+version: 0.2.0
 description: Hadoop Distributed File System (HDFS) hosted by Kubernetes.

charts/hdfs-journalnode-k8s/templates/journalnode-statefulset.yaml

@@ -13,8 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# TODO: Support Kerberos for journal nodes.
-
 # A headless service to create DNS records.
 apiVersion: v1
 kind: Service
@@ -78,6 +76,20 @@ spec:
           env:
             # The following env vars are listed according to low-to-high precedence order.
             # i.e. Whoever comes last will override the earlier value of the same variable.
+          {{- if .Values.kerberosEnabled }}
+            - name: CORE_CONF_hadoop_security_authentication
+              value: kerberos
+            - name: CORE_CONF_hadoop_security_authorization
+              value: "true"
+            - name: CORE_CONF_hadoop_rpc_protection
+              value: privacy
+            - name: HDFS_CONF_dfs_journalnode_kerberos_principal
+              value: hdfs/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+            - name: HDFS_CONF_dfs_journalnode_kerberos_internal_spnego_principal
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+            - name: HDFS_CONF_dfs_journalnode_keytab_file
+              value: /etc/security/hdfs.keytab
+            {{- end }}
             {{- range $key, $value := .Values.customHadoopConfig }}
             - name: {{ $key | quote }}
               value: {{ $value | quote }}
@@ -94,7 +106,45 @@ spec:
           volumeMounts:
             - name: editdir
               mountPath: /hadoop/dfs/journal
+           {{- if .Values.kerberosEnabled }}
+            - name: kerberos-config
+              mountPath: /etc/krb5.conf
+              subPath: {{ .Values.kerberosConfigFileName }}
+              readOnly: true
+            - name: kerberos-keytab-copy
+              mountPath: /etc/security/
+              readOnly: true
+            {{- end }}
+     {{- if .Values.kerberosEnabled }}
+      initContainers:
+        - name: copy-kerberos-keytab
+          image: busybox:1.27.1
+          command: ['sh', '-c']
+          args:
+            - cp /kerberos-keytabs/${MY_KERBEROS_NAME}*.keytab /kerberos-keytab-copy/hdfs.keytab
+          env:
+            - name: MY_KERBEROS_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: kerberos-keytabs
+              mountPath: /kerberos-keytabs
+            - name: kerberos-keytab-copy
+              mountPath: /kerberos-keytab-copy
+      {{- end }}
       restartPolicy: Always
+      {{- if .Values.kerberosEnabled }}
+      volumes:
+        - name: kerberos-config
+          configMap:
+            name: {{ .Values.kerberosConfigMap }}
+        - name: kerberos-keytabs
+          secret:
+            secretName: {{ .Values.kerberosKeytabsSecret }}
+        - name: kerberos-keytab-copy
+          emptyDir: {}
+      {{- end }}
       {{- if .Values.podSecurityContext.enabled }}
       securityContext:
         runAsUser: {{ .Values.podSecurityContext.runAsUser }}

charts/hdfs-journalnode-k8s/values.yaml

@@ -27,3 +27,26 @@ podSecurityContext:
   enabled: false
   runAsUser: 0
   fsGroup: 1000
+
+# Whether or not Kerberos support is enabled.
+kerberosEnabled: false
+
+# Required to be non-empty if Kerberos is enabled. Specify your Kerberos realm name.
+# This should match the realm name in your Kerberos config file.
+kerberosRealm: ""
+
+# Effective only if Kerberos is enabled. Name of the k8s config map containing
+# the kerberos config file.
+kerberosConfigMap: kerberos-config
+
+# Effective only if Kerberos is enabled. Name of the kerberos config file inside
+# the config map.
+kerberosConfigFileName: krb5.conf
+
+# Effective only if Kerberos is enabled. Name of the k8s secret containing
+# the kerberos keytab files of per-host HDFS principals. The secret should
+# have multiple data items. Each data item name should be formatted as:
+#    `HOST-NAME.keytab`
+# where HOST-NAME should match the cluster node
+# host name that each per-host hdfs principal is associated with.
+kerberosKeytabsSecret: hdfs-kerberos-keytabs

charts/hdfs-namenode-k8s/Chart.yaml

@@ -1,17 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+apiVersion: v1
 name: hdfs-namenode-k8s
-version: 0.2
+version: 0.2.0
 description: Hadoop Distributed File System (HDFS) hosted by Kubernetes.

charts/hdfs-namenode-k8s/README.md

@@ -48,6 +48,11 @@ See the other chart for `datanodes`.
         $ kubectl create configmap kerberos-config --from-file=/etc/krb5.conf
        ```
 
+       We have our own kerberos server in the `krb5-server` helm chart.
+       Currently, this is used mainly by the integration tests. But you may
+       choose to use this for your cluster as well. For details, see
+       the integration test case `tests/cases/_kerberos.sh`.
+
      - Generate per-host principal accounts and password keytab files for the namenode
        and datanode daemons. This is typically done in your Kerberos KDC host. For example,
        suppose the namenode will run on the k8s cluster node kube-n1.mycompany.com,
@@ -56,23 +61,23 @@ See the other chart for `datanodes`.
 
        ```
         $ kadmin.local -q "addprinc -randkey hdfs/[email protected]"
-        $ kadmin.local -q "addprinc -randkey http/[email protected]"
+        $ kadmin.local -q "addprinc -randkey HTTP/[email protected]"
         $ mkdir hdfs-keytabs
         $ kadmin.local -q "ktadd -norandkey  \
                   -k hdfs-keytabs/kube-n1.mycompany.com.keytab  \
                   hdfs/[email protected]  \
-                  http/[email protected]"
+                  HTTP/[email protected]"
 
         $ kadmin.local -q "addprinc -randkey hdfs/[email protected]"
-        $ kadmin.local -q "addprinc -randkey http/[email protected]"
+        $ kadmin.local -q "addprinc -randkey HTTP/[email protected]"
         $ kadmin.local -q "ktadd -norandkey  \
                   -k hdfs-keytabs/kube-n2.mycompany.com.keytab  \
                   hdfs/[email protected]  \
-                  http/[email protected]"
+                  HTTP/[email protected]"
         $ kadmin.local -q "ktadd -norandkey  \
                   -k hdfs-keytabs/kube-n2.mycompany.com.keytab  \
                   hdfs/[email protected]  \
-                  http/[email protected]"
+                  HTTP/[email protected]"
        ```
 
      - Create a k8s secret containing all the keytab files. This will be mounted
@@ -120,15 +125,19 @@ See the other chart for `datanodes`.
      If enabling Kerberos, specify necessary options. For instance,
      ```
      $ helm install -n my-hdfs-namenode  \
-         --set kerberosEnabled=true,kerberosRealm=MYCOMPANY.COM hdfs-namenode-k8s
+         --set kerberosEnabled=true  \
+         --set kerberosRealm=MYCOMPANY.COM  \
+         hdfs-namenode-k8s
      ```
      The two variables above are required. For other variables, see values.yaml.
 
      If also using namenode labels for Kerberos, add
      the namenodePinningEnabled option:
      ```
      $ helm install -n my-hdfs-namenode  \
-         --set kerberosEnabled=true,kerberosRealm=MYCOMPANY.COM,namenodePinningEnabled=true \
+         --set kerberosEnabled=true  \
+         --set kerberosRealm=MYCOMPANY.COM  \
+         --set namenodePinningEnabled=true \
          hdfs-namenode-k8s
      ```
 

charts/hdfs-namenode-k8s/templates/namenode-statefulset.yaml

@@ -150,11 +150,15 @@ spec:
             # TODO: Check if the https principal is no longer needed in newer
             # Hadoop version.
             - name: HDFS_CONF_dfs_namenode_kerberos_https_principal
-              value: http/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             - name: HDFS_CONF_dfs_web_authentication_kerberos_principal
-              value: http/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             - name: HDFS_CONF_dfs_namenode_keytab_file
               value: /etc/security/hdfs.keytab
+            - name: HDFS_CONF_dfs_journalnode_kerberos_principal
+              value: hdfs/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
+            - name: HDFS_CONF_dfs_journalnode_kerberos_internal_spnego_principal
+              value: HTTP/_HOST@{{ required "A valid kerberosRealm entry required!" .Values.kerberosRealm }}
             {{- end }}
             {{- range $key, $value := .Values.customHadoopConfig }}
             - name: {{ $key | quote }}
@@ -223,12 +227,16 @@ spec:
           image: busybox:1.27.1
           command: ['sh', '-c']
           args:
-            - cp /kerberos-keytabs/$MY_NODE_NAME.keytab /kerberos-keytab-copy/hdfs.keytab
+            - cp /kerberos-keytabs/${MY_KERBEROS_NAME}*.keytab /kerberos-keytab-copy/hdfs.keytab
           env:
-            - name: MY_NODE_NAME
+            - name: MY_KERBEROS_NAME
               valueFrom:
                 fieldRef:
+                {{- if .Values.hostNetworkEnabled }}
                   fieldPath: spec.nodeName
+                {{- else }}
+                  fieldPath: metadata.name
+                {{- end }}
           volumeMounts:
             - name: kerberos-keytabs
               mountPath: /kerberos-keytabs

charts/hdfs-simple-namenode-k8s/Chart.yaml

@@ -1,17 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+apiVersion: v1
 name: hdfs-simple-namenode-k8s
-version: 0.2
+version: 0.2.0
 description: Hadoop Distributed File System (HDFS) hosted by Kubernetes.

charts/krb5-server/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/krb5-server/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: A Helm chart for Kerberos server
+name: krb5-server
+version: 0.1.0

charts/krb5-server/README.md

@@ -0,0 +1,8 @@
+---
+layout: global
+title: Kerberos server chart
+---
+
+# Kerberos server chart
+Helm charts for launching a Kerberos server. Currently, this is used mainly
+for integration tests.