[KYUUBI apache#3744][Bug] InvalidACL appears in engine after upgrade …

…to Kyuubi 1.6.0
zhouyifan279 · Nov 7, 2022 · ed5e8bd · ed5e8bd
1 parent 84297ea
commit ed5e8bd
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/docs/deployment/migration-guide.md b/docs/deployment/migration-guide.md
@@ -20,4 +20,8 @@
 
 ## Upgrading from Kyuubi 1.6 to 1.7
 
-* Since Kyuubi 1.7, Kyuubi returns engine's information for `GetInfo` request instead of server. To restore the previous behavior, set `kyuubi.server.info.provider` to `SERVER`.
+* Since Kyuubi 1.7, Kyuubi returns engine's information for `GetInfo` request instead of server. 
+To restore the previous behavior, set `kyuubi.server.info.provider` to `SERVER`.
+* Since Kyuubi 1.7, `kyuubi.kinit.principal` & `kyuubi.kinit.keytab` are filter out from Kyuubi engine's conf for better security. 
+In order to do kerberos authentication with zookeeper, we need to set `kyuubi.ha.zookeeper.engine.auth.type` to `KERBEROS`
+and set `kyuubi.ha.zookeeper.auth.principal` & `kyuubi.ha.zookeeper.auth.keytab`.
diff --git a/kyuubi-ha/src/main/scala/org/apache/kyuubi/ha/HighAvailabilityConf.scala b/kyuubi-ha/src/main/scala/org/apache/kyuubi/ha/HighAvailabilityConf.scala
@@ -88,7 +88,9 @@ object HighAvailabilityConf {
       .doc("The type of zookeeper authentication for engine, all candidates are " +
         s"${AuthTypes.values.mkString("<ul><li>", "</li><li> ", "</li></ul>")}")
       .version("1.3.2")
-      .fallbackConf(HA_ZK_AUTH_TYPE)
+      .stringConf
+      .checkValues(AuthTypes.values.map(_.toString))
+      .createWithDefault(AuthTypes.NONE.toString)
 
   val HA_ZK_AUTH_PRINCIPAL: ConfigEntry[Option[String]] =
     buildConf("kyuubi.ha.zookeeper.auth.principal")