[jira] [Created] (YARN-11954) ContainerLaunch should use system credentials for updated delegation tokens

["ZhenyuLi (Jira)" <ji...@apache.org>]

ZhenyuLi created YARN-11954:
-------------------------------

             Summary: ContainerLaunch should use system credentials for updated delegation tokens
                 Key: YARN-11954
                 URL: https://issues.apache.org/jira/browse/YARN-11954
             Project: Hadoop YARN
          Issue Type: Bug
          Components: nodemanager
    Affects Versions: 3.4.3, 3.4.1
            Reporter: ZhenyuLi


When the RM's DelegationTokenRenewer replaces an HDFS delegation token that has reached its max lifetime (via requestNewHdfsDelegationTokenIfNeeded), the new token is pushed to NodeManagers through the
  heartbeat response as systemCredentials.

  On the NM side, ResourceLocalizationService.writeCredentials() correctly checks NMContext.getSystemCredentialsForApps() and uses the updated token when writing the localizer's credential file. However,
  ContainerLaunch does not — it writes the container's token file using only container.getCredentials(), which still holds the original (now invalid) token.

  This means that for long-running applications (running beyond delegation.token.max-lifetime, default 7 days), newly launched or re-initialized containers may receive stale HDFS delegation tokens and fail
   with authentication errors when accessing HDFS.

  Affected code path:
  ContainerLaunch.call() → writes nmPrivateTokensPath using container.getCredentials() without checking systemCredentials.

  Working code path (for reference):
  ResourceLocalizationService.LocalizerRunner.writeCredentials() → checks getSystemCredentialsSentFromRM() and uses updated credentials.

  Fix: Add a getEffectiveCredentials() method in ContainerLaunch that merges system credentials into the container credentials before writing the token file, mirroring the localizer's behavior.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org