集群开启hdfs sentry acl权限同步，一直很稳定的运行，某天突然出现hive权限问题，hive通过hs2 访问的不受影响，hive cli访问全部失败(不推荐使用hive cli 命令)，其它任务访问hive表路径失败，用hdfs getfacl命令查看，权限同步目录acl全部失效，集群基本无法访问，查看sentry，hive正常， 日志都没有异常信息，查看namenode日志出现如下异常：
java.lang.NullPointerException
at org.apache.sentry.hdfs.HMSPaths$Entry.access$200(HMSPaths.java:146)
at org.apache.sentry.hdfs.HMSPaths.renameAuthzObject(HMSPaths.java:879)
at org.apache.sentry.hdfs.UpdateableAuthzPaths.applyPartialUpdate(UpdateableAuthzPaths.java:118)
at org.apache.sentry.hdfs.UpdateableAuthzPaths.updatePartial(UpdateableAuthzPaths.java:81)
at org.apache.sentry.hdfs.SentryAuthorizationInfo.processUpdates(SentryAuthorizationInfo.java:211)
at org.apache.sentry.hdfs.SentryAuthorizationInfo.update(SentryAuthorizationInfo.java:139)
at org.apache.sentry.hdfs.SentryAuthorizationInfo.run(SentryAuthorizationInfo.java:232)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
从日志可以看到namenode出现了NPE，日志是sentry-hdfs包中打出来的，hdfs同步sentry权限出现了问题，将namenode 分别重启问题解决(namenode启用HA)，集群恢复正常。
后续跟踪,查看sentry源码(版本cdh5.14.4)：
看到这段代码想到修复方式：判断下oldEntry是否为空，空不处理，不为空调用moveTo处理。在apache issues系统中找到了两个跟这个异常相关的issues
https://issues.apache.org/jira/browse/SENTRY-1184
https://issues.apache.org/jira/browse/SENTRY-2299
这次出行的bug就是SENTRY-2299，补丁修改如下：
if (!oldPathElements.equals(newPathElements)) {
Entry oldEntry = root.find(oldPathElements.toArray(new String[0]), false);
Entry newParent = root.createParent(newPathElements);
if (oldEntry == null) {
LOG.warn(String.format("%s Moving old paths for renameAuthzObject({%s, %s} -> {%s, %s}) is skipped. Cannot find entry for old name",
this, oldName, assemblePaths(oldPathElems), newName, assemblePaths(newPathElems)));
} else {
oldEntry.moveTo(newParent, newPathElements.get(newPathElements.size() - 1));
}
}
这个bug一般很难被触发发现，触发原因：仅当用户重命名其位置不在哨兵托管前缀内的表时，才会出现此问题。
SENTRY-1184 在cdh5.6被修复，apache sentry1.8修复
SENTRY-2299 在cdh5.15.1修复，apache sentry2.1修复
可以在github上找到对应版本查看修复后的源码：
https://github.com/apache/sentry
https://github.com/cloudera/sentry
不升级修复cdh5.14.4bug，从git下载对应源码解压，修改sentry-hdfs-common 下HMSPaths.java类879行，执行mvn install -DskipTests,等待执行完成：
用编译完的sentry-hdfs-common-1.5.1-cdh5.14.4.jar替换旧的包，重启namenode，sentry角色。