[
https://issues.apache.org/jira/browse/HADOOP-9747?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16133331#comment-16133331
]
Daryn Sharp commented on HADOOP-9747:
-------------------------------------
When security is enabled, new ugi instances defaulted to unconditionally
claiming to be kerberos authenticated - unless explicitly defined at creation,
or redefined by something like the ipc server. Now a ugi defaults to kerberos
only if it's kerberos.
The yarn tests inadvertently relied on the bad behavior. They failed because
token ops must be kerberos authenticated. The yarn tests aren't really using
kerberos, so they bypassed the ipc layer (which would have set the auth to
kerberos) and called straight into the token methods. Formerly the dummy ugis
were implicitly kerberos, so the tests passed. Now the ugis are simple because
that's what they really are, hence the tests failed. All it takes is
explicitly setting the auth type to kerberos and they pass. Will file a couple
line yarn jira.
> Reduce unnecessary UGI synchronization
> --------------------------------------
>
> Key: HADOOP-9747
> URL: https://issues.apache.org/jira/browse/HADOOP-9747
> Project: Hadoop Common
> Issue Type: Bug
> Components: security
> Affects Versions: 0.23.0, 2.0.0-alpha, 3.0.0-alpha1
> Reporter: Daryn Sharp
> Assignee: Daryn Sharp
> Priority: Critical
> Attachments: HADOOP-9747.2.branch-2.patch, HADOOP-9747.2.trunk.patch,
> HADOOP-9747.branch-2.patch, HADOOP-9747.trunk.patch
>
>
> Jstacks of heavily loaded NNs show up to dozens of threads blocking in the
> UGI.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
