[
https://issues.apache.org/jira/browse/YARN-7907?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16357587#comment-16357587
]
Eric Yang commented on YARN-7907:
---------------------------------
This problem can happen due to the following reasons:
# If user is not authorized in hadoop-policy.xml, it will prevent SPNEGO token
to be sent from client to server side.
# Hard code zookeeper.sasl.client.username=zookeeper in YARN_OPTS in
yarn-env.sh. User is unable to read zookeeper znodes to find active resource
manager.
Both problems are configuration mistakes, and they are not bugs in the current
YARN code. Therefore, close this as working as designed.
> Yarn app CLI client does not send Kerberos header to Resource Manager rest API
> ------------------------------------------------------------------------------
>
> Key: YARN-7907
> URL: https://issues.apache.org/jira/browse/YARN-7907
> Project: Hadoop YARN
> Issue Type: Bug
> Components: yarn-native-services
> Affects Versions: 3.0.0
> Reporter: Yesha Vora
> Priority: Critical
>
> Launch of yarn service app is failing in secure mode with below stacktrace.
> {code:java}
> [hrt_qa@xxx root]$ kinit -kt
> /home/hrt_qa/hadoopqa/keytabs/hrt_qa.headless.keytab hrt_qa
> [hrt_qa@xxx root]$ yarn app -launch test2 sleeper
> WARNING: YARN_LOG_DIR has been replaced by HADOOP_LOG_DIR. Using value of
> YARN_LOG_DIR.
> WARNING: YARN_LOGFILE has been replaced by HADOOP_LOGFILE. Using value of
> YARN_LOGFILE.
> WARNING: YARN_PID_DIR has been replaced by HADOOP_PID_DIR. Using value of
> YARN_PID_DIR.
> WARNING: YARN_OPTS has been replaced by HADOOP_OPTS. Using value of YARN_OPTS.
> 18/02/07 22:50:40 WARN util.NativeCodeLoader: Unable to load native-hadoop
> library for your platform... using builtin-java classes where applicable
> 18/02/07 22:50:41 INFO client.AHSProxy: Connecting to Application History
> server at xxx/xxx:10200
> 18/02/07 22:50:41 INFO client.AHSProxy: Connecting to Application History
> server at xxx/xxx:10200
> 18/02/07 22:50:41 INFO client.ApiServiceClient: Loading service definition
> from local FS:
> /usr/hdp/3.0.0.0-800/hadoop-yarn/yarn-service-examples/sleeper/sleeper.json
> 18/02/07 22:50:42 ERROR client.ApiServiceClient: Authentication required{code}
> CLI client does not send Kerberos header to Resource Manager rest API.
> Tcpdump indicate that there is no token being sent.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
