[
https://issues.apache.org/jira/browse/SPARK-19588?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15865005#comment-15865005
]
Marcelo Vanzin commented on SPARK-19588:
----------------------------------------
>From a feature perspective this is probably ok, but I'm not sure this has any
>security benefits over the existing approach. You still need a valid local
>kerberos login, otherwise you can't start the application on YARN (or download
>the file from HDFS so you can login using it).
> Allow putting keytab file to HDFS location specified in spark.yarn.keytab
> -------------------------------------------------------------------------
>
> Key: SPARK-19588
> URL: https://issues.apache.org/jira/browse/SPARK-19588
> Project: Spark
> Issue Type: New Feature
> Components: Spark Core, Spark Submit
> Affects Versions: 2.0.2, 2.1.0
> Environment: kerberized cluster, Spark 2
> Reporter: Ruslan Dautkhanov
> Labels: authentication, kerberos, security, yarn-client
>
> As a workaround for SPARK-19038 tried putting keytab in user's home directory
> in HDFS but this fails with
> {noformat}
> Exception in thread "main" org.apache.spark.SparkException: Keytab file:
> hdfs:///user/svc_odiprd/.kt does not exist
> at
> org.apache.spark.deploy.SparkSubmit$.prepareSubmitEnvironment(SparkSubmit.scala:555)
> at org.apache.spark.deploy.SparkSubmit$.submit(SparkSubmit.scala:158)
> at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:124)
> at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)
> {noformat}
> This is yarn-client mode, so driver probably can't see HDFS while submitting
> a job; although I suspect it doesn't not only with yarn-client.
> Would be great to support reading keytab for kerberos ticket renewals
> directly from HDFS.
> We think that in some scenarios it's more secure than referencing a keytab
> from a local fs on a client machine that does a spark-submit.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
