Cloudera Docs

Known Issues in Flow Management

Learn about the known issues in Flow Management clusters, the impact or changes to the functionality, and the workaround.

NiFi cannot connect to NiFi Registry
By default, NiFi is configured with a NiFi Registry client to interact with the NiFi Registry instance. The URL used to configure the Registry client may not be correct depending on your deployment model for CDP Public Cloud. For example: 
https://***gateway***/.../.../cdp-proxy/nifi-registry-app/nifi-registry/

If the URL is not correct, you may face "connect timed out" errors when interacting with NiFi Registry from the NiFi UI.

You can manually change the configuration of the client and provide the right FQDN of the management node of the DataHub cluster where the NiFi Registry instance is installed. To update the NiFi Registry client, go into the top right Actions menu, and select Controller Settings | Registry Clients. A correct URL will look similar to: 
https://***management0***/.../cdp-proxy/nifi-registry-app/nifi-registry/
JDK versions mismatch
If doing a software only upgrade for your Flow Management DataHub clusters and if repairing one of the NiFi nodes after the upgrade, you may be in a situation where the JDK used by NiFi is not the same across the nodes. In such a case, this may cause issues in the NiFi UI and you may get an "Unexpected error" message.
Ensure that the same JDK is used across the NiFi nodes and if there is a JDK versions mismatch, manually upgrade the JDK to match the JDK version being installed on the node that has been repaired.
NiFi UI Performance considerations
A known issue in Chrome 92.x causes significant slowness in the NiFi UI and may lead to high CPU consumption. For more information, see the Chrome Known Issues documentation at 1235045.
Use another version of Chrome or a different browser.

Technical Service Bulletins

TSB 2022-580: NiFi Processors cannot write to content repository

If the content repository disk is filled more than 50% (or any other value that is set in nifi.properties for nifi.content.repository.archive.max.usage.percentage), and if there is no data in the content repository archive, the following warning message can be found in the logs: "Unable to write flowfile content to content repository container default due to archive file size constraints; waiting for archive cleanup". This would block the processors and no more data is processed.

This appears to only happen if there is already data in the content repository on startup that needs to be archived, or if the following message is logged: “Found unknown file XYZ in the File System Repository; archiving file”.

Upstream JIRA
Action required
  • Upgrade (recommended)
    Upgrade to a version containing the fix.
    • CFM-2.2.5.2 for CDP 7.2.15.2
    • CFM-2.2.4.2 for CDP 7.2.14.3
    • CFM-2.2.3.4 for CDP 7.2.12.7
  • Workaround
    • Increase the value associated to nifi.content.repository.archive.max.usage.percentage (example: 75%).

      OR

    • Reduce disk space usage to get under the configured threshold.
Knowledge article
For the latest update on this issue see the corresponding Knowledge article: TSB 2022-580: NiFi Processors cannot write to content repository
TSB 2022-589: CVE-2022-33140 Apache NiFi ShellUserGroupProvider Vulnerability
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers (UGP) in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.
CVE
Severity:
Impact
Operating System level command injection could cause security vulnerability in the Apache NiFi environment.
Action required
An option is to use another User Group Provider (such as the LDAP User Group Provider) if it is possible. Otherwise, customers are asked to upgrade to a release containing the fix, or to request a HOTFIX through the support portal.
Knowledge article
For the latest update on this issue see the corresponding Knowledge article: TSB 2022-589: CVE-2022-33140 Apache NiFi ShellUserGroupProvider Vulnerability