Github user vanzin commented on a diff in the pull request:

    https://github.com/apache/spark/pull/19272#discussion_r150053337
  
    --- Diff: 
resource-managers/mesos/src/main/scala/org/apache/spark/scheduler/cluster/mesos/MesosHadoopDelegationTokenManager.scala
 ---
    @@ -0,0 +1,180 @@
    +/*
    + * Licensed to the Apache Software Foundation (ASF) under one or more
    + * contributor license agreements.  See the NOTICE file distributed with
    + * this work for additional information regarding copyright ownership.
    + * The ASF licenses this file to You under the Apache License, Version 2.0
    + * (the "License"); you may not use this file except in compliance with
    + * the License.  You may obtain a copy of the License at
    + *
    + *    http://www.apache.org/licenses/LICENSE-2.0
    + *
    + * Unless required by applicable law or agreed to in writing, software
    + * distributed under the License is distributed on an "AS IS" BASIS,
    + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    + * See the License for the specific language governing permissions and
    + * limitations under the License.
    + */
    +
    +package org.apache.spark.scheduler.cluster.mesos
    +
    +import java.security.PrivilegedExceptionAction
    +import java.util.concurrent.{ScheduledExecutorService, TimeUnit}
    +
    +import org.apache.hadoop.conf.Configuration
    +import org.apache.hadoop.security.UserGroupInformation
    +
    +import org.apache.spark.SparkConf
    +import org.apache.spark.deploy.SparkHadoopUtil
    +import org.apache.spark.deploy.security.HadoopDelegationTokenManager
    +import org.apache.spark.internal.{config, Logging}
    +import org.apache.spark.rpc.RpcEndpointRef
    +import 
org.apache.spark.scheduler.cluster.CoarseGrainedClusterMessages.UpdateDelegationTokens
    +import org.apache.spark.util.ThreadUtils
    +
    +
    +/**
    + * The MesosHadoopDelegationTokenManager fetches and updates Hadoop 
delegation tokens on the behalf
    + * of the MesosCoarseGrainedSchedulerBackend. It is modeled after the YARN 
AMCredentialRenewer,
    + * and similarly will renew the Credentials when 75% of the renewal 
interval has passed.
    + * The principal difference is that instead of writing the new credentials 
to HDFS and
    + * incrementing the timestamp of the file, the new credentials (called 
Tokens when they are
    + * serialized) are broadcast to all running executors. On the executor 
side, when new Tokens are
    + * received they overwrite the current credentials.
    + */
    +private[spark] class MesosHadoopDelegationTokenManager(
    +    conf: SparkConf, hadoopConfig: Configuration,
    +    driverEndpoint: RpcEndpointRef)
    +  extends Logging {
    +
    +  private val credentialRenewerThread: ScheduledExecutorService =
    +    ThreadUtils.newDaemonSingleThreadScheduledExecutor("Credential Renewal 
Thread")
    +
    +  private val tokenManager: HadoopDelegationTokenManager =
    +    new HadoopDelegationTokenManager(conf, hadoopConfig)
    +
    +  private val principal: String = conf.get(config.PRINCIPAL).orNull
    +
    +  private val (secretFile: String, mode: String) = getSecretFile(conf)
    +
    +  private var (tokens: Array[Byte], timeOfNextRenewal: Long) = {
    +    try {
    +      val creds = UserGroupInformation.getCurrentUser.getCredentials
    +      val hadoopConf = SparkHadoopUtil.get.newConfiguration(conf)
    +      val rt = tokenManager.obtainDelegationTokens(hadoopConf, creds)
    +      logInfo(s"Initialized tokens: 
${SparkHadoopUtil.get.dumpTokens(creds)}")
    +      (SparkHadoopUtil.get.serialize(creds), rt)
    +    } catch {
    +      case e: Exception =>
    +        throw new IllegalStateException("Failed to initialize Hadoop 
delegation tokens\n" +
    +          s"\tPricipal: $principal\n\tmode: $mode\n\tsecret file 
$secretFile\n\tException: $e")
    +    }
    +  }
    +
    +  scheduleTokenRenewal()
    +
    +  private def getSecretFile(conf: SparkConf): (String, String) = {
    +    val keytab = conf.get(config.KEYTAB).orNull
    +    val tgt = conf.getenv("KRB5CCNAME")
    +    require(keytab != null || tgt != null, "A keytab or TGT required.")
    --- End diff --
    
    Is that really the case? `KRB5CCNAME` is not a required env variable. It 
has a default value, and the `UGI` class will use the credentials from the 
default location if they're available (and reloading the cache periodically).
    
    So I think you don't really need this, but just to track whether there's a 
principal and keytab. And you don't need to call `getUGIFromTicketCache` later 
on since I'm pretty sure UGI takes care of that for you.


---

---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscr...@spark.apache.org
For additional commands, e-mail: reviews-h...@spark.apache.org

Reply via email to