Should I call ugi.checkTGTAndReloginFromKeytab() before every action on hadoop?
<p>In my server application I'm connecting to Kerberos secured Hadoop cluster from my java application. I'm using various components like the HDFS file system, Oozie, Hive etc. On the application startup I do call</p>

<pre><code>UserGroupInformation.loginUserFromKeytabAndReturnUGI( ... );
</code></pre>

<p>This returns me <code>UserGroupInformation</code> instance and I keep it for application lifetime. When doing privileged action I launch them with <code>ugi.doAs(action)</code>. </p>

<p>This works fine but I wonder if and when should I renew the kerberos ticket in <code>UserGroupInformation</code>? I found a method <code>UserGroupInformation.checkTGTAndReloginFromKeytab()</code> which seems to do the ticket renewal whenever it's close to expiry. I also found that this method is being called by various Hadoop tools like <code>WebHdfsFileSystem</code> for example.</p>

<p>Now if I want my server application (possibly running for months or even years) to never experience ticket expiry what is the best approach? To provide concrete questions:</p>

<ol>
<li>Can I rely on the various Hadoop clients they call <code>checkTGTAndReloginFromKeytab</code> whenever it's needed?  </li>
<li>Should I call ever <code>checkTGTAndReloginFromKeytab</code> myself in my code?</li>
<li>If so should I do that before every single call to <code>ugi.doAs(...)</code> or rather setup a timer and call it periodically (how often)?</li>
</ol>