# 1. 用户获取票据
$ kinit fgeduuser@FGEDU.NET.CN
Password for fgeduuser@FGEDU.NET.CN:

# 2. 验证票据
$ klist

Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: fgeduuser@FGEDU.NET.CN

Valid starting Expires Service principal
04/08/2026 13:00:00 04/09/2026 13:00:00 krbtgt/FGEDU.NET.CN@FGEDU.NET.CN

# 3. 提交Spark应用
$ /bigdata/app/spark/bin/spark-submit \
–master yarn \
–deploy-mode client \
–principal fgeduuser@FGEDU.NET.CN \
–keytab /etc/security/keytabs/fgeduuser.keytab \
–class com.fgedu.spark.FgeduApp \
/bigdata/spark-apps/fgedu-app.jar

2026-04-08 13:00:00 INFO SparkContext:54 – Running Spark version 3.5.1
2026-04-08 13:00:01 INFO SecurityManager:54 – SecurityManager: authentication enabled=true
2026-04-08 13:00:02 INFO SparkContext:54 – Kerberos principal: fgeduuser@FGEDU.NET.CN
2026-04-08 13:00:03 INFO SparkContext:54 – Kerberos keytab: /etc/security/keytabs/fgeduuser.keytab
…
2026-04-08 13:00:30 INFO Client:54 – Application report for application_1680940800000_0001 (state: RUNNING)

# 4. 访问HDFS
$ hdfs dfs -ls /user/fgeduuser

Found 2 items
drwxr-xr-x – fgeduuser fgeduusers 0 2026-04-08 13:00 /user/fgeduuser/data
drwxr-xr-x – fgeduuser fgeduusers 0 2026-04-08 13:00 /user/fgeduuser/output

# 5. 销毁票据
$ kdestroy

# 自动续期配置
spark.kerberos.renewal.credentials=keytab
spark.kerberos.renewal.time=1h

# 1. 创建租户用户
kadmin.local: addprinc tenant1@FGEDU.NET.CN
kadmin.local: addprinc tenant2@FGEDU.NET.CN

# 2. 创建租户组
$ groupadd tenant1users
$ groupadd tenant2users

# 3. 配置队列隔离
# capacity-scheduler.xml yarn.scheduler.capacity.root.queues
tenant1,tenant2 yarn.scheduler.capacity.root.tenant1.capacity
50 yarn.scheduler.capacity.root.tenant2.capacity
50

# 4. 配置HDFS隔离
$ hdfs dfs -mkdir /user/tenant1
$ hdfs dfs -mkdir /user/tenant2
$ hdfs dfs -chown tenant1:tenant1users /user/tenant1
$ hdfs dfs -chown tenant2:tenant2users /user/tenant2
$ hdfs dfs -chmod 700 /user/tenant1
$ hdfs dfs -chmod 700 /user/tenant2

# 5. 配置Hive隔离
scala> spark.sql(“CREATE DATABASE tenant1_db”)
scala> spark.sql(“CREATE DATABASE tenant2_db”)
scala> spark.sql(“GRANT ALL ON DATABASE tenant1_db TO USER tenant1”)
scala> spark.sql(“GRANT ALL ON DATABASE tenant2_db TO USER tenant2”)

# 6. 提交租户应用
$ kinit tenant1@FGEDU.NET.CN

$ spark-submit \
–master yarn \
–queue tenant1 \
–principal tenant1@FGEDU.NET.CN \
–keytab /etc/security/keytabs/tenant1.keytab \
/bigdata/spark-apps/tenant1-app.jar

# 7. 验证隔离
# tenant1只能访问自己的队列和数据
$ yarn application -list -appStates RUNNING

Total number of applications (application types: [] and states: [RUNNING]):1
Application-Id Application-Name
application_1680940800000_0001 tenant1-app

# 排查步骤
# 1. 检查票据
$ klist

# 2. 检查时间同步
$ ntpdate -q 192.168.1.1

# 3. 检查Principal
$ kadmin.local -q “listprincs”

# 解决方案
# 1. 同步时间
$ ntpdate 192.168.1.1

# 2. 重新获取票据
$ kdestroy
$ kinit fgeduuser@FGEDU.NET.CN

# 3. 检查krb5.conf
[libdefaults]
default_realm = FGEDU.NET.CN
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d

[realms]
FGEDU.NET.CN = {
kdc = kdc1.fgedu.net.cn
kdc = kdc2.fgedu.net.cn
admin_server = kdc1.fgedu.net.cn
}

# 排查步骤
# 1. 检查ACL配置
$ cat /bigdata/app/spark/conf/spark-defaults.conf | grep acl

# 2. 检查用户组
$ groups fgeduuser

# 3. 检查HDFS权限
$ hdfs dfs -ls /user/fgeduuser

# 解决方案
# 1. 添加用户到组
$ usermod -aG fgeduusers fgeduuser

# 2. 修改ACL配置
spark.modify.acls.groups=sparkusers,fgeduusers

# 3. 修改HDFS权限
$ hdfs dfs -chmod 755 /user/fgeduuser
$ hdfs dfs -chown fgeduuser:fgeduusers /user/fgeduuser