flink-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (FLINK-5580) Kerberos keytabs not working for YARN deployment mode
Date Fri, 20 Jan 2017 07:06:26 GMT

    [ https://issues.apache.org/jira/browse/FLINK-5580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15831322#comment-15831322

ASF GitHub Bot commented on FLINK-5580:

GitHub user tzulitai opened a pull request:


    [FLINK-5580] [security] Fix path setting of shipped Kerberos keytabs in YARN mode

    Previously, the local path of the shipped keytab was set _after_ `SecurityConfiguration`
was created, causing the picked up keytab path to be invalid and validation of the security
configuration not passing.

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/tzulitai/flink FLINK-5580

Alternatively you can review and apply these changes as the patch at:


To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #3177
commit 871c6a6601af33f57c3794d6f627a874ac4c8731
Author: Tzu-Li (Gordon) Tai <tzulitai@apache.org>
Date:   2017-01-20T00:41:05Z

    [FLINK-5580] [security] Fix path setting of shipped Kerberos keytabs in YARN mode


> Kerberos keytabs not working for YARN deployment mode
> -----------------------------------------------------
>                 Key: FLINK-5580
>                 URL: https://issues.apache.org/jira/browse/FLINK-5580
>             Project: Flink
>          Issue Type: Bug
>          Components: Security, YARN
>            Reporter: Tzu-Li (Gordon) Tai
>            Assignee: Tzu-Li (Gordon) Tai
>            Priority: Critical
>             Fix For: 1.2.0
> Setup: Kerberos security using keytabs, Flink session on YARN deployment (in standalone,
it works fine without problems).
> I’m getting these error messages in the YARN node managers, causing the TaskManager
containers to fail to start properly:
> {{org.apache.hadoop.security.UserGroupInformation: PriviledgedActionException as:tzulitai
(auth:SIMPLE) cause:org.apache.hadoop.security.AccessControlException: Client cannot authenticate
> The security configuration for Hadoop has been set to "kerberos", to the "auto: SIMPLE"
seems very strange. It also seems as if credential tokens has not been properly set for the
{{ContainerLaunchContext}} s, which may be an issue causing this.

This message was sent by Atlassian JIRA

View raw message