Insert after alter table on Acid table causes ArrayIndexOutOfBoundsException

Issue: Schema evolution is not supported for Acid tables. Alter Table commands on Acid table may make the table unreadable. There is not w/a after that.

Ambari ranger-env settings for admin and usersync log dir don't seem to do anything.

Issue: The log directory specified for the ranger-admin and ranger-usersync component configurations are not being used in the current release.

Alter table transactional=false on ACID table misleading user. create transactional table would be better

Issue: Once an ACID table is created (with transactional=true) and data is written to it, changing the property to transactional=false may cause wrong data to be returned by queries over this table.

Meta WALs are not split or cleared

Issue: In case a meta region gets moved from one region server to another region server, the write ahead logs for the meta table might be left in the HDFS directory for the regionserver if that particular regionserver fails. This might leave the WAL files in that directory until they are removed manually, and also may result in the previous regionservers to be listed as "dead regionservers" in the master UI indefinitely. However, this is harmless and does not cause any data loss other operational issues in HBase.

UserSync - group sync is marked as INTERNAL even if the group is synced from LDAP

Issue: When the groups are synched from LDAP/AD, the ranger admin portal is showing the group as INTERNAL group instead of EXTERNAL group. It does not affect any functionality of Ranger.

After local index changes, the explain plan could show scan over the physical data table name instead of the local index. The query plan contains index id, for example -32766, represents using local indexes.

After local index changes, the explain plan could show scan over the physical data table name instead of the local index. The query plan contains index id, for example -32766, represents using local indexes.

Phoenix is returning wrong or empty results when querying split tables.

If region merges or splits are happening for tables with local indexes, the queries that are running during the split/merge might end up seeing invalid results.

Phoenix-queryServer ha is failing with RejectedExecutionException

Issue: It is possible the clients using the Phoenix QueryServer might unexpectedly see application-level exceptions when the QueryServer is in the process of shutting down.

Workaround: Users should simply resubmit their query against an operation Phoenix QueryServer instance.

Using empty master secret for Knox causes NullPointerException

Issue: If an empty string is used as the Knox master secret the Knox gateway server will fail to start and a NullPointerException will be found in the gateway.log file.

Error: The error found in the gateway.log file will appear as shown below. More information can be produced by modifying the gateway-log4j.properties file.

2015-12-10 17:03:30,389 INFO  hadoop.gateway (GatewayServer.java:startGateway(217)) - Starting gateway...
2015-12-10 17:03:30,579 FATAL hadoop.gateway (GatewayServer.java:startGateway(234)) - Failed to start gateway: java.lang.NullPointerException

Workaround: User can recover from this situation by replacing the empty string master secret with another value using the command below. This command should be executed as the 'Knox' user.

bin/knoxcli.sh create-master --force

If this does not solve the problem it may be necessary to delete the contents of the data/security directory before executing this command.

Configuring KafkaSpout to Connect to HBase or Hive

Before connecting to HBase or Hive, we recommend that you add the following exclusions to your POM file, for the curator framework:

<exclusion>
  <groupId>org.apache.curator</groupId>
  <artifactId>curator-client</artifactId>
</exclusion>

<exclusion>
  <groupId>org.apache.curator</groupId>
  <artifactId>curator-recipes</artifactId>
</exclusion>

<exclusion>
  <groupId>org.apache.curator</groupId>
  <artifactId>apache-curator</artifactId>
</exclusion>

Issue: Hue does not start on upgraded openssl libs on SUSE.

Error Message: Could not import desktop.auth.views. Error was: libssl.so.1.0.0: cannot open shared object file: No such file or directory

Workaround:

Issue: The Phoenix Thin Client Driver, org.apache.phoenix.queryserver.client.Driver, is not automatically registered in the JDBC DriverManager.

Workaround:

Tracking URL/history link not functional when ATS v1.5 is enabled

Issue:When YARN Timeline v1.5 is enabled, the Tracking URL link from the YARN ResourceManager UI to the Tez View may not function correctly.

Workaround: Directly go to the Tez View and search for the YARN Application.

Kafka file system support

Issue: Encrypted file systems such as SafenetFS are not supported for Kafka. Index file corruption can occur.

For more information, see: Install Kafka.

Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

Microsoft has introduced changes in LDAP Signing and LDAP Channel Binding to increase the security for communications between LDAP clients and Active Directory domain controllers. These optional changes will have an impact on how 3rd party products integrate with Active Directory using the LDAP protocol.

Workaround

Disable LDAP Signing and LDAP Channel Binding features in Microsoft Active Directory if they are enabled

For more information on this issue, see the corresponding Knowledge article: TSB-2021 405: Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

WebHDFS clients might send SPNEGO authorization header to remote URL without proper verification. A maliciously crafted request can trigger services to send server credentials to a webhdfs path (ie: webhdfs://…) for capturing the service principal

For more information on this issue, see the corresponding Knowledge article: TSB-2021 406: CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

For more information on this issue, see the corresponding Knowledge article: TSB 2020-434: KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

Corruption of HBase data stored with MOB feature

For more information on this issue, see the corresponding Knowledge article: TSB 2021-465: Corruption of HBase data stored with MOB feature on upgrade from CDH 5 and HDP 2

CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

The Apache Solr ReplicationHandler (normally registered at "/replication" under a Solr core) has a "masterUrl" (also "leaderUrl" alias) parameter. The “masterUrl” parameter is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To help prevent the CVE-2021-27905 SSRF vulnerability, Solr should check these parameters against a similar configuration used for the "shards" parameter.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-497: CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

HBase MOB data loss

HBase tables with the MOB feature enabled may encounter problems which result in data loss.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-512: HBase MOB data loss