What causes "Kerberos re-login from keytab failed: {}" in apache/seatunnel?

Verify kerberos_principal, kerberos_keytab_path in the source/sink config point to an existing, readable keytab with the matching principal

apache/seatunnel · warning

Kerberos re-login from keytab failed: {}

Error message

Kerberos re-login from keytab failed: {}

What it means

A WARN from HadoopFileSystemProxy.maybeRelogin: the periodic Kerberos TGT refresh (UserGroupInformation.checkTGTAndReloginFromKeytab) threw an IOException. The current operation (wrapped in doAsPrivileged) still proceeds with the existing credentials; if the TGT is truly expired, subsequent HDFS/file operations will fail with authentication errors.

Source

Thrown at seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopFileSystemProxy.java:549

        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException(e);
        }
    }

    private void maybeRelogin() {
        if (!isAuthTypeKerberos) {
            return;
        }
        if (userGroupInformation == null) {
            return;
        }
        try {
            if (userGroupInformation.isFromKeytab()) {
                userGroupInformation.checkTGTAndReloginFromKeytab();
            }
        } catch (IOException e) {
            log.warn("Kerberos re-login from keytab failed: {}", e.getMessage());
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

Verify kerberos_principal, kerberos_keytab_path in the source/sink config point to an existing, readable keytab with the matching principal
Test kinit -kt <keytab> <principal> on the SeaTunnel node and confirm the KDC is reachable from every worker
Check clock sync (ntp/chrony) between client nodes and the KDC
If the error repeats, watch for subsequent 'Failed on local exception' / 'Security token expired' errors — those mean re-login truly failed and the job will fail

Example fix

// before (typical misconfig)
kerberos_keytab_path = "/old/path/user.keytab"
// after
kerberos_keytab_path = "/etc/security/keytabs/user.keytab"
kerberos_principal = "user@REALM.EXAMPLE.COM"

Defensive patterns

Strategy: validation

Validate before calling

// on every worker node before the job:
// kinit -kt /etc/security/keytabs/user.keytab user@REALM && klist -e
// and check clock: ntpq -p (or chronyc tracking)

Try / catch

// re-login failure is swallowed; watch for follow-up auth failures:
// try { files = listFiles(path); } catch (IOException e) {
//   if (String.valueOf(e).contains("Security") || String.valueOf(e).contains("token expired")) reKinitAndRetry();
// }

Prevention

Verify keytab path/principal config on every node, not just the client
Keep KDC reachable and clocks synced (chrony/ntp) cluster-wide
Set hdfs-site/core-site Kerberos properties consistently across the job classpath
Alert on this log plus any subsequent 'token expired' errors — together they mean the job will fail

When it happens

Trigger: doAsPrivileged -> maybeRelogin runs before file operations; UGI.isFromKeytab() is true but checkTGTAndReloginFromKeytab fails — keytab file missing/unreadable, KDC unreachable, principal mismatch, or clock skew between client and KDC.

Common situations: Long-running jobs whose TGT lifetime (e.g. 24h) expires mid-run with a misconfigured keytab path; krb5.conf pointing to an unreachable KDC; wrong principal in the keytab; VM clock drift breaking Kerberos time validation.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/e48741c271fd1d7b. Report an issue: GitHub.