apache/seatunnel · warning

Kerberos re-login for HiveMetaStore failed: {}

Error message

Kerberos re-login for HiveMetaStore failed: {}

What it means

HiveMetaStoreCatalog.maybeRelogin, invoked from getClient, attempts a Kerberos re-login via UserGroupInformation.checkTGTAndReloginFromKeytab() when the UGI was created from a keytab. If the re-login attempt itself throws (I/O error reading the keytab, KDC unreachable, principal problems), the code logs this warning and swallows the exception, proceeding with the possibly-stale UGI. The next HMS RPC may then fail with a Kerberos/GSS authentication error.

Source

Thrown at seatunnel-connectors-v2/connector-hive/src/main/java/org/apache/seatunnel/connectors/seatunnel/hive/utils/HiveMetaStoreCatalog.java:707

    }

    @Override
    public synchronized void close() throws CatalogException {
        if (Objects.nonNull(hiveClient)) {
            hiveClient.close();
        }
    }

    private void maybeRelogin() {
        if (userGroupInformation == null) {
            return;
        }
        try {
            if (userGroupInformation.isFromKeytab()) {
                userGroupInformation.checkTGTAndReloginFromKeytab();
            }
        } catch (Exception e) {
            log.warn("Kerberos re-login for HiveMetaStore failed: {}", e.getMessage());
        }
    }

    private CatalogTable convertHiveTableToCatalogTable(Table hiveTable) {
        List<org.apache.seatunnel.api.table.catalog.Column> columns = new ArrayList<>();

        if (hiveTable.getSd() != null && hiveTable.getSd().getCols() != null) {
            for (org.apache.hadoop.hive.metastore.api.FieldSchema field :
                    hiveTable.getSd().getCols()) {
                org.apache.seatunnel.api.table.type.SeaTunnelDataType<?> dataType =
                        HiveTypeConvertor.covertHiveTypeToSeaTunnelType(
                                field.getName(), field.getType());
                columns.add(
                        org.apache.seatunnel.api.table.catalog.PhysicalColumn.of(
                                field.getName(), dataType, 0, true, null, field.getComment()));
            }
        }

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify the keytab exists and is readable by the job user on every node: check the principal and keytab path passed to UserGroupInformation.loginUserFromKeytab.
2. Synchronize clocks across cluster nodes with NTP/chrony to avoid KDC clock-skew rejections.
3. Confirm krb5.conf is correct and the KDC is reachable from worker nodes; test with `kinit -kt /path/keytab principal`.
4. Check KDC ticket lifetimes (max_renewable_life) allow re-login; if tickets cannot renew, reduce job duration or renew tickets externally.
5. Watch for subsequent 'Failed to specify server's Kerberos principal' or GSSException errors in getClient calls — those are the downstream symptoms of this swallowed warning.

// Pre-flight Kerberos check before job start:
UserGroupInformation ugi = UserGroupInformation.getLoginUser();
if (ugi.isFromKeytab()) {
    Process k = new ProcessBuilder("klist", "-kt", keytabPath).start();
    if (k.waitFor() != 0) throw new IllegalStateException("Keytab unreadable: " + keytabPath);
}

// maybeRelogin swallows the exception, so guard the downstream HMS call instead:
try {
    IMetaStoreClient client = catalog.getClient(); // triggers maybeRelogin
    client.getAllDatabases();
} catch (TException | IOException e) {
    // Likely stale Kerberos ticket after failed re-login
    UserGroupInformation.getLoginUser().reloginFromKeytab();
    throw new CatalogException("HMS auth failed after Kerberos re-login problem", e);
}

When it happens

Trigger: A long-running job whose Kerberos ticket lifetime (max lifetime / renew lifetime in KDC) expires while isFromKeytab() is true and checkTGTAndReloginFromKeytab() fails to refresh — e.g. keytab file moved or permission changed, KDC temporarily unavailable, clock skew between nodes exceeding allowed tolerance.

Common situations: Jobs running longer than the Kerberos ticket lifetime (default often 24h); keytab not distributed to all worker nodes or path wrong in krb5.conf/hive config; clock drift causing 'Clock skew too great' KDC errors; Hadoop security (hadoop.security.authentication=kerberos) misconfigured.

Related errors

• KERBEROS_AUTHENTICATION_FAILED
• Failed to login user from keytab : ${kerberosKeytabFilePath}
• Kerberos authentication is not configured, it will skip kerb
• Please set kerberosPrincipal
• Please set kerberosKeytabPath

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/b80ed7f74e5d62e6. Report an issue: GitHub.