hadoop-yarn-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Steve Loughran (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (YARN-4653) Document YARN security model from the perspective of Application Developers
Date Fri, 05 Feb 2016 17:21:40 GMT

     [ https://issues.apache.org/jira/browse/YARN-4653?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Steve Loughran updated YARN-4653:
---------------------------------
    Attachment: YARN-4653-003.patch

Patch 003. Try to clarify renewal vs regeneration, cut the proposed "Regen through reboot"
strategy.

Regarding renewal, i'm now confused about what the application needs to do here. 

What should an app do in terms of running anything in its own process to refresh/renew tokens?

> Document YARN security model from the perspective of Application Developers
> ---------------------------------------------------------------------------
>
>                 Key: YARN-4653
>                 URL: https://issues.apache.org/jira/browse/YARN-4653
>             Project: Hadoop YARN
>          Issue Type: Task
>          Components: site
>    Affects Versions: 2.7.2
>            Reporter: Steve Loughran
>            Assignee: Steve Loughran
>         Attachments: YARN-4653-001.patch, YARN-4653-002.patch, YARN-4653-003.patch
>
>   Original Estimate: 2h
>  Remaining Estimate: 2h
>
> What YARN apps need to do for security today is generally copied direct from distributed
shell, with a bit of [ill-informed superstition|https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/sections/yarn.html]
being the sole prose.
> We need a normative document in the YARN site covering
> # the needs for YARN security
> # token creation for AM launch
> # how the RM gets involved
> # token propagation on container launch
> # token renewal strategies
> # How to get tokens for other apps like HBase and Hive.
> # how to work under OOzie
> Perhaps the WritingYarnApplications.md doc is updated, otherwise why not just link to
the relevant bit of the distributed shell client on github for a guarantee of staying up to
date?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message