使用Oozie在Hive上执行查询时如何修复"Delegation Token can be issued only with kerberos or web authentication"?



当我尝试通过使用Oozie中的Hive上下文查询Hive获得的数据框时,我会得到以下异常。什么可能是问题

Caused by: org.apache.spark.sql.catalyst.errors.package$TreeNodeException: execute, tree:
TungstenExchange hashpartitioning
at org.apache.spark.sql.catalyst.errors.package$.attachTree(package.scala:49)
    at org.apache.spark.sql.execution.Exchange.doExecute(Exchange.scala:247)
    at org.apache.spark.sql.execution.SparkPlan$$anonfun$execute$5.apply(SparkPlan.scala:132)
    at org.apache.spark.sql.execution.SparkPlan$$anonfun$execute$5.apply(SparkPlan.scala:130)
    at org.apache.spark.rdd.RDDOperationScope$.withScope(RDDOperationScope.scala:150)
    at org.apache.spark.sql.execution.SparkPlan.execute(SparkPlan.scala:130)
Caused by: org.apache.hadoop.ipc.RemoteException(java.io.IOException): Delegation Token can be issued only with kerberos or web authentication
    at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getDelegationToken(FSNamesystem.java:7496)
    at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.getDelegationToken(NameNodeRpcServer.java:548)
    at org.apache.hadoop.hdfs.server.namenode.AuthorizationProviderProxyClientProtocol.getDelegationToken(AuthorizationProviderProxyClientProtocol.java:663)
    at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.getDelegationToken(ClientNamenodeProtocolServerSideTranslatorPB.java:981)

这是因为Oozie在启动Spark Action之前已经获得了代表团令牌。

解决方案是要求Spark不要通过在WorkFlow中的Spark Action中添加到Spark Action.xml:

来再次获得委托令牌。
<spark-opts>--conf spark.yarn.security.tokens.hive.enabled=false</spark-opts>

上面的分析是正确的,但是该解决方案对我不起作用。相反,也可以告诉Spark忽略Oozie已经要求的令牌,这为我做了:

--conf spark.yarn.security.tokens.hadoopfs.enabled=false
--conf spark.yarn.security.credentials.hadoopfs.enabled=false

最新更新