feat: support connecting Python Hive3 Namespace to a Kerberos-secured Hive Metastore

[zouhuajian]

Background

The current Python Hive3Namespace implementation only supports plain Thrift connections to Hive Metastore and cannot connect to Kerberized HMS deployments with hive.metastore.sasl.enabled=true.

Changes

This PR adds Kerberos SASL support to the Python Hive3Namespace implementation while keeping the existing non-secure behavior unchanged.

Main changes include:

• add Kerberos SASL support to the Python Hive3 metastore wrapper
• use a Kerberos SASL transport when hive.metastore.sasl.enabled=true
• keep the existing plain Thrift path when SASL is not enabled
• support the following optional properties:
  • hive.metastore.kerberos.principal
  • kerberos.service-name
  • kerberos.client-principal
• add the required Python hive3 dependencies
• add/update corresponding unit tests
• update the Hive3 documentation

Configuration behavior

• hive.metastore.sasl.enabled is disabled by default
• kerberos.service-name takes precedence when explicitly configured
• otherwise it may be derived from hive.metastore.kerberos.principal
• kerberos.client-principal is optional; if omitted, local default Kerberos credentials are used

Impact

This change enables the Python Hive3 Namespace to work with Kerberized Hive Metastore deployments without affecting existing non-SASL users.

Testing

This PR includes test updates covering:

• default plain client behavior
• Kerberos configuration parsing
• Kerberos client selection when SASL is enabled
• plain client selection when SASL is disabled

Notes

This change is scoped to Kerberos SASL support for the Python Hive3 Namespace only. It does not modify the Java Hive3 implementation and does not introduce a Kerberos integration test environment in this iteration.

---

Assisted by ChatGPT

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4caf76f6d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".