liangrui198 commented on PR #27795: URL: https://github.com/apache/flink/pull/27795#issuecomment-4159472236
> Why don't you just remove `HadoopModule` from modules config? This is a very good question - instead of adding a switch, it's better to directly remove the keytab/principal of the TM end from the root. I traced the principal and keytab config under KerberosLoginProvider.java. [KerberosLoginProvider.java L41](https://github.com/apache/flink/blob/c0265db9903d4a4a23072f94893da94ed4c3ae85/flink-runtime/src/main/java/org/apache/flink/runtime/security/token/hadoop/KerberosLoginProvider.java#L41) All callers, but it was directly found that removing the configuration would have an impact. The fundamental reason is that SecurityUtils.install() treats JM, TM, Client, and HistoryServer completely the same, lacking the concept of "process role". Currently, only the minimum changes are made to solve the TM KDC repeated login issue, but the code readability is indeed poor. The radical solution seems to require a refactoring of HadoopModule, splitting different roles to manage their own HadoopModule, which will take some time and extensive testing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
