[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-827278120 @XComp Done -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-818561960 @XComp Thanks for your reply > I'm still not comfortable with this change considering that it's not tested. Have you had the chance to check whether it works? Could you provide this manual test in a reproducible fashion (e.g. docker) or is this too much of an effort? Sorry, I am not very familiar with the Flink code. Can you provide a test case link about with kerberos HDFS? I want to refer to it and add test case. **How to reproduce it?** I think you can fetch HDFS delegation token before submitting Flink job on Yarn, it will throw exception. > Based on what I read about it, the issue is that Apache Oozie utilizes Apache Hadoop's ProxyUser which impersonates the actual user which has access to the actual data. I still don't understand why the delegation token fetching causes an error. Is it because the Flink job would be still submitted under the "normal" user instead of the Oozie user? Not yet. Oozie will submit Flink job without keytab and only rely on delegation token to access HDFS. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-806434957 Update commits. Please check it. @XComp @lirui-apache @wangyang0918 @KarmaGYZ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-800851949 Thanks @XComp. Ok, i will attach a detailed manual test in this PR later. This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-800262780 Do i need to submit another PR about changing `identify` to `service` in credentials? Actually there is no relationship between this PR and `identify` changes. @XComp This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-799882439 > Hi @zuston and thanks for your contribution. > I'm wondering whether we can test that Flink is behaving in the right way when disabling the newly introduced flag. Right now, no test is covering this specific behavior. It only works when credentials existed in UGI and no keytab is specified. I think It's hard to test, could you give me some ideas on it? @XComp This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-799047577 > @zuston Could you squash your PR into one commit? Also the CI failed because of the style check, you could execute `mvn com.diffplug.spotless:spotless-maven-plugin:apply` to resolve it. Done. Thanks This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-797370875 > Thank for the PR. I'm still trying to understand this change. Left some minor comments. Also, you should change the commit message/title following the format "[[FLINK-21700](https://issues.apache.org/jira/browse/FLINK-21700)][yarn] ". Ok. i will force push it to correct commit log later. This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [flink] zuston commented on pull request #15131: [FLINK-21700][yarn]Allow to disable fetching Hadoop delegation token on Yarn
zuston commented on pull request #15131: URL: https://github.com/apache/flink/pull/15131#issuecomment-796384256 Hi @lirui-apache , @XComp , could you help to review this PR? Thanks This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org
