hadoop-yarn-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Steve Loughran (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (YARN-4653) Document YARN security model from the perspective of Application Developers
Date Wed, 10 Feb 2016 13:11:18 GMT

    [ https://issues.apache.org/jira/browse/YARN-4653?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15140742#comment-15140742
] 

Steve Loughran commented on YARN-4653:
--------------------------------------

ok, to confirm then

# the token handed off by the RM to the NM to localize is refreshed/updated as needed.
# no tokens in the app launch context are refreshed. That is, if it has an out of date hdfs
token —that token is not renewed
# therefore, to survive AM restart after token failure, your AM has to get the NMs to localize
the keytab or make no HDFS accesses until (somehow) a new token has been passed to them from
a client.

This is what I will say

> Document YARN security model from the perspective of Application Developers
> ---------------------------------------------------------------------------
>
>                 Key: YARN-4653
>                 URL: https://issues.apache.org/jira/browse/YARN-4653
>             Project: Hadoop YARN
>          Issue Type: Task
>          Components: site
>    Affects Versions: 2.7.2
>            Reporter: Steve Loughran
>            Assignee: Steve Loughran
>         Attachments: YARN-4653-001.patch, YARN-4653-002.patch, YARN-4653-003.patch
>
>   Original Estimate: 2h
>  Remaining Estimate: 2h
>
> What YARN apps need to do for security today is generally copied direct from distributed
shell, with a bit of [ill-informed superstition|https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/sections/yarn.html]
being the sole prose.
> We need a normative document in the YARN site covering
> # the needs for YARN security
> # token creation for AM launch
> # how the RM gets involved
> # token propagation on container launch
> # token renewal strategies
> # How to get tokens for other apps like HBase and Hive.
> # how to work under OOzie
> Perhaps the WritingYarnApplications.md doc is updated, otherwise why not just link to
the relevant bit of the distributed shell client on github for a guarantee of staying up to
date?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message