hadoop-yarn-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jian He (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (YARN-4653) Document YARN security model from the perspective of Application Developers
Date Sun, 07 Feb 2016 01:58:40 GMT

    [ https://issues.apache.org/jira/browse/YARN-4653?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15136094#comment-15136094

Jian He commented on YARN-4653:

bq. what about the tokens supplied to the container launch context for the container to start
at all?
sorry, not sure i understand what you mean. in case of MR, any tokens in the containerLaunchContext(supplied
by user) will remain the same. Those tokens are not refreshed and will expire eventually.
 The hdfs token used for localization is indeed refreshed - RM requests a new token on user's
behalf and distributes that to NM's localization service. Tokens for any other services (ATS,
Hive) supplied by user are not refreshed 

The patch looks good. Only my earlier comment :
I tried to compile the html file and find that below has some format problem. Only the first
line is recognized as the title. 
### AM keytab distributed via YARN; AM regenerates delegation
336	tokens for containers.

> Document YARN security model from the perspective of Application Developers
> ---------------------------------------------------------------------------
>                 Key: YARN-4653
>                 URL: https://issues.apache.org/jira/browse/YARN-4653
>             Project: Hadoop YARN
>          Issue Type: Task
>          Components: site
>    Affects Versions: 2.7.2
>            Reporter: Steve Loughran
>            Assignee: Steve Loughran
>         Attachments: YARN-4653-001.patch, YARN-4653-002.patch, YARN-4653-003.patch
>   Original Estimate: 2h
>  Remaining Estimate: 2h
> What YARN apps need to do for security today is generally copied direct from distributed
shell, with a bit of [ill-informed superstition|https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/sections/yarn.html]
being the sole prose.
> We need a normative document in the YARN site covering
> # the needs for YARN security
> # token creation for AM launch
> # how the RM gets involved
> # token propagation on container launch
> # token renewal strategies
> # How to get tokens for other apps like HBase and Hive.
> # how to work under OOzie
> Perhaps the WritingYarnApplications.md doc is updated, otherwise why not just link to
the relevant bit of the distributed shell client on github for a guarantee of staying up to

This message was sent by Atlassian JIRA

View raw message