Fixed issues and resolved maintenance items for Oozie are addressed in Cloudera Runtime 7.3.2, its service packs and cumulative
hotfixes.
Cloudera Runtime 7.3.2.10000 SP1
- CDPD-104226: Spark3 actions fail to connect to Hive
due to masked trust store passwords
- 7.3.2.10000
- Previously, Oozie provided the
hive-site.xml content to Spark3 actions from a file
that is directory generated by Cloudera Manager for Oozie
servers. This version of the file often contained masked trust store
passwords (example, ********), causing Spark3 actions to fail when
connecting to Hive enabled with a
java.security.UnrecoverableKeyException
configuration. This issue is now resolved and Oozie provides the
hive-site.xml content to Spark3 actions directly
from /etc/hive/conf/ on the Oozie server hosts,
ensuring that trust store properties are correctly passed.
If the old
behavior is required, you can set
oozie.service.SparkConfigurationService.hive2.configurations:*=hive-conf
in the Oozie Server Advanced Configuration Snippet (Safety
Valve) for oozie-site.xml.
- CDPD-104576: Oozie failed to connect to HBase when
ZooKeeper was configured for TLS-only connections
- 7.3.2.10000
- Previously, Oozie failed to connect to HBase
when ZooKeeper was configured for TLS-only connections because it did not
pass the necessary trust store properties to the HBase client. This resulted
in connection timeouts and failures during HBase delegation token fetching
and Spark3 actions. This issue is now fixed and Oozie uses the
hbase-site.xml configuration and passes the
required HBase-ZooKeeper TLS properties directly to the connection
client.
- CDPD-101770: Oozie Git action failed in FIPS-140-3
environments due to trust store access issues
- 7.3.2.10000
- Previously, Oozie's Git action validated
configured GitHub endpoints using the Java default
cacerts
trust store. In FIPS-140-3 environments, where every trust store was
required to be password-protected, the Git action failed because it could
not access the protected cacerts file. This issue is now
fixed and allows you to configure a password-protected trust store for
Oozie's Git action (such as the cacerts file, Cloudera Manager's Auto TLS trust store, or any other
custom trust store) by providing the trust store location, type, and
password through a .jceks file. This is also available
for use in non-FIPS environments.
- CDPD-96982: Oozie created an unnecessary and insecure
/services ZNode in ZooKeeper
- 7.3.2.10000
- Previously, Oozie incorrectly created an unused
/services ZNode in ZooKeeper with insecure ACL
permissions (
world:anyone:cdrwa), even when secure
ZooKeeper configuration was enabled. This occurred due to a deprecated code
path that ignored the intended Oozie namespace. This issue is now fixed and
Oozie correctly uses only the /oozie/services ZNode for
service discovery, so the redundant /services ZNode is
no longer created.
Cloudera Runtime 7.3.2.100 CHF 1
There are no fixed issues in this release.
Cloudera Runtime 7.3.2
Cloudera Runtime 7.3.2 resolves Oozie issues and incorporates fixes
from the service packs and cumulative hotfixes from 7.3.1.100 through 7.3.1.700. For
a comprehensive record of all fixes in
Cloudera Runtime 7.3.1.x,
see
Fixed Issues.
- CDPD-93325: Hive2Main.java can print out
passwords
- 7.3.2
- Previously, Hive2Main was printing full
Beeline command arguments to standard output, which might
unintentionally expose LDAP credentials and the truststore password.
This issue is now fixed.
- CDPD-78506:Inconsistent PATH environment variable
evaluation for Shell actions
- 7.3.2
- Previously, the PATH environment variable
for Oozie Shell actions was evaluated on the Oozie server JVM. This
issue is now fixed. The PATH is now evaluated based on the YARN
NodeManager host settings and applies directly to the Launcher AM
container during execution.. You can revert to the legacy behavior by
setting the
oozie.action.shell.setup-path-in-oozie-server
parameter to true in the
oozie-site.xml file.
Additionally, the new
the
oozie.launcher.<***ACTION_TYPE***>.action.env.<***VARIABLE_NAME***>
parameter is introduced. This allows you to define action-specific
environment variables to customize the execution environments for
each action type in the Launcher AM.
- CDPD-78069: Oozie action configuration fails to
apply Java options after CDPD-60551
- 7.3.2
- Previously, specific Java options and
Hadoop properties were not correctly applied to the Oozie launcher
configuration. This issue is now resolved. The new
oozie.service.HadoopAccessorService.global.yarn.java-options-keys
parameter is now introduced, allowing you to configure a comma-separated
list of Hadoop properties to be passed to the Oozie launcher if they are
not already set in Oozie using the oozie.launcher.<hadoop
property key> property or within its workflows.
The
default properties in this list are
yarn.app.mapreduce.am.admin-command-opts
and yarn.app.mapreduce.am.command-opts. The
oozie.LauncherConfigurationInjector.hadoop.search.properties
property is now deprecated.
- CDPD-77768: Oozie log parameters are not
substituted correctly
- 7.3.2
- Previously, Oozie log parameters, for
example,
{0}, were not substituted when log messages
contained apostrophes. The formatting engine treated the text following
a single quote as a literal block, preventing parameter replacement.
This issue is now fixed. Oozie now automatically escapes single quotes
in log messages, ensuring that all parameters are substituted
correctly.
- CDPD-76135: Schema check database connection
throws PSQLException
- 7.3.2
- The schema check now completes successfully
during Oozie startup for secure database connections or when custom
connection properties are used, preventing warnings from appearing in
the logs.
- CDPD-68425: Oozie does not validate the backend
database identifiers in a case-insensitive way
- 7.3.2
- Previously, Oozie incorrectly reported
missing tables due to issues with table name casing. This issue is now
fixed.
