[
https://issues.apache.org/jira/browse/YARN-6669?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16271879#comment-16271879
]
Eric Yang commented on YARN-6669:
---------------------------------
ServiceScheduler tries to register the application in zookeeper, but it seems
to fail with secure ZooKeeper:
AM Log output:
{code}
2017-11-30 00:13:04,343 [pool-5-thread-1] ERROR service.ServiceScheduler -
Failed to register app ww4 in registry
{code}
ZooKeeper log:
{code}
2017-11-30 00:21:22,164 - INFO [ProcessThread(sid:0
cport:-1)::PrepRequestProcessor@643] - Got user-level KeeperException when
processing sessionid:0x15fe03595b30090 type:create cxid:0x46 zxid:0xa21e5
txntype:-1 reqpath:n/a Error
Path:/registry/users/spark/services/yarn-service/ww4 Error:KeeperErrorCode =
NoNode for /registry/users/spark/services/yarn-service/ww4
{code}
> Support security for YARN service framework
> -------------------------------------------
>
> Key: YARN-6669
> URL: https://issues.apache.org/jira/browse/YARN-6669
> Project: Hadoop YARN
> Issue Type: Sub-task
> Reporter: Jian He
> Assignee: Jian He
> Attachments: YARN-6669.01.patch, YARN-6669.02.patch,
> YARN-6669.03.patch, YARN-6669.04.patch, YARN-6669.05.patch,
> YARN-6669.06.patch, YARN-6669.07.patch, YARN-6669.08.patch,
> YARN-6669.09.patch, YARN-6669.10.patch,
> YARN-6669.yarn-native-services.01.patch,
> YARN-6669.yarn-native-services.03.patch,
> YARN-6669.yarn-native-services.04.patch,
> YARN-6669.yarn-native-services.05.patch
>
>
> Changes include:
> - Make registry client to programmatically generate the jaas conf for secure
> access ZK quorum
> - Create a KerberosPrincipal resource object in REST API for user to supply
> keberos keytab and principal
> - User has two ways to configure:
> -- If keytab starts with "hdfs://", the keytab will be localized by YARN
> -- If keytab starts with "file://", it is assumed that the keytab are
> available on the localhost.
> - AM will use the keytab to log in
> - ServiceClient is changed to ask hdfs delegation token when submitting the
> service
> - AM code will use the tokens when launching containers
> - Support kerberized communication between client and AM
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
