Daryn Sharp commented on YARN-3055:

Two apps could double renew tokens (completely benign) before this patch.  In 
practice the possibility is slim and its harmless. 

However, currently it's quite buggy. Both apps renewed and then stomped over 
each other's dttrs in allTokens.  Now both apps reference separate yet 
equivalent dttr instances, when the intention was only one app should reference 
a token.  A second/duplicate timer task was also scheduled.  Haven't bothered 
to check later fallout from the inconsistencies.

Patch: A double renew can still occur (unavoidable) but only one timer is 
scheduled.  All apps reference the same dttr instance.  Moving the logic down 
only creates 3 loops instead of 2 loops but I'll do if you feel strongly.

> The token is not renewed properly if it's shared by jobs (oozie) in 
> DelegationTokenRenewer
> ------------------------------------------------------------------------------------------
>                 Key: YARN-3055
>                 URL: https://issues.apache.org/jira/browse/YARN-3055
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: security
>            Reporter: Yi Liu
>            Assignee: Daryn Sharp
>            Priority: Blocker
>         Attachments: YARN-3055.001.patch, YARN-3055.002.patch, YARN-3055.patch
> After YARN-2964, there is only one timer to renew the token if it's shared by 
> jobs. 
> In {{removeApplicationFromRenewal}}, when going to remove a token, and the 
> token is shared by other jobs, we will not cancel the token. 
> Meanwhile, we should not cancel the _timerTask_, also we should not remove it 
> from {{allTokens}}. Otherwise for the existing submitted applications which 
> share this token will not get renew any more, and for new submitted 
> applications which share this token, the token will be renew immediately.
> For example, we have 3 applications: app1, app2, app3. And they share the 
> token1. See following scenario:
> *1).* app1 is submitted firstly, then app2, and then app3. In this case, 
> there is only one token renewal timer for token1, and is scheduled when app1 
> is submitted
> *2).* app1 is finished, then the renewal timer is cancelled. token1 will not 
> be renewed any more, but app2 and app3 still use it, so there is problem.

This message was sent by Atlassian JIRA

Reply via email to