Mailing-List: contact yarn-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: yarn-issues@hadoop.apache.org
Date: Thu, 24 Dec 2015 01:01:55 +0000 (UTC)
From: "Karthik Kambatla (JIRA)" <jira@apache.org>
To: yarn-issues@hadoop.apache.org
Message-ID: <JIRA.12912615.1447364940000.106669.1450918915960@Atlassian.JIRA>
In-Reply-To: <JIRA.12912615.1447364940000@Atlassian.JIRA>
References: <JIRA.12912615.1447364940000@Atlassian.JIRA>
 <JIRA.12912615.1447364940263@arcas>
Subject: [jira] [Commented] (YARN-4353) Provide short circuit user group
 mapping for NM/AM
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/YARN-4353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15070358#comment-15070358 ] 

Karthik Kambatla commented on YARN-4353:
----------------------------------------

bq. If secure LDAP is configured for group mapping, then there are some additional complications created by the unnecessary group resolution.
Could you elaborate? What complications? 

I would think Vinod's suggestion here should work, albeit a more substantial change. Could you also comment on how the change here helps/hurts the long-term overall fix? 

> Provide short circuit user group mapping for NM/AM
> --------------------------------------------------
>
>                 Key: YARN-4353
>                 URL: https://issues.apache.org/jira/browse/YARN-4353
>             Project: Hadoop YARN
>          Issue Type: Improvement
>          Components: nodemanager
>    Affects Versions: 2.7.1
>            Reporter: Daniel Templeton
>            Assignee: Daniel Templeton
>         Attachments: YARN-4353.prelim.patch
>
>
> When the NM launches an AM, the {{ContainerLocalizer}} gets the current user from {{UserGroupInformation}}, which triggers user group mapping, even though the user groups are never accessed.  If secure LDAP is configured for group mapping, then there are some additional complications created by the unnecessary group resolution.  Additionally, it adds unnecessary latency to the container launch time.
> To address the issue, before getting the current user, the {{ContainerLocalizer}} should configure {{UserGroupInformation}} with a null group mapping service that quickly and quietly returns an empty group list for all users.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)