You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by GitBox <gi...@apache.org> on 2022/12/05 07:47:03 UTC

[GitHub] [hive] abstractdog opened a new pull request, #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

abstractdog opened a new pull request, #3626:
URL: https://github.com/apache/hive/pull/3626

   ### What changes were proposed in this pull request?
   <!--
   Please clarify what changes you are proposing. The purpose of this section is to outline the changes and how this PR fixes the issue. 
   If possible, please consider writing useful notes for better and faster reviews in your PR. See the examples below.
     1. If you refactor some codes with changing classes, showing the class hierarchy will help reviewers.
     2. If you fix some SQL features, you can provide some references of other DBMSes.
     3. If there is design documentation, please add the link.
     4. If there is a discussion in the mailing list, please add the link.
   -->
   
   
   ### Why are the changes needed?
   <!--
   Please clarify why the changes are needed. For instance,
     1. If you propose a new API, clarify the use case for a new API.
     2. If you fix a bug, you can clarify why it is a bug.
   -->
   
   
   ### Does this PR introduce _any_ user-facing change?
   <!--
   Note that it means *any* user-facing change including all aspects such as the documentation fix.
   If yes, please clarify the previous behavior and the change this PR proposes - provide the console output, description, screenshot and/or a reproducable example to show the behavior difference if possible.
   If possible, please also clarify if this is a user-facing change compared to the released Hive versions or within the unreleased branches such as master.
   If no, write 'No'.
   -->
   
   
   ### How was this patch tested?
   <!--
   If tests were added, say they were added here. Please make sure to add some test cases that check the changes thoroughly including negative and positive cases if possible.
   If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future.
   If tests were not added, please describe why they were not added and/or why it was difficult to add.
   -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1261095290

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [13 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041216835


##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);

Review Comment:
   I see your point...yeah, the constant interval LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS is not supposed to be configured by the user, it's part of the token refresh internals (5mins period), and it's independent of the token renewal interval (which is by default much larger, days): it controls how quickly the AM reacts to the fact that there is some change in the token validity
   
   the idea here was that: let's say somebody is testing this feature (expert) and want to make it act quite quickly (within a minute), and we still don't want a separate config option for the LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, instead, if tokenRenewInterval is low (60s), we can limit the actual interval to that (60s/2 = 30s), because it doesn't make sense to run with a tokenRenewInterval 1 minute but  running a periodic check with the original LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, which is 5 mins
   
   I agree that this logic can be confusing, especially because in production the token renew interval should not be like minutes
   
   I think we can clarify this reason further with a code comment and/or remove this hack altogether, and have it like this:
   ```
   long interval = Math.min(tokenRenewInterval, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] ayushtkn commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
ayushtkn commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1042178119


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -403,9 +401,8 @@ public void indicateError(Throwable t) {
                   + " appId=" + currentQueryIdentifierProto.getApplicationIdString()
                   + " dagId=" + currentQueryIdentifierProto.getDagIndex()
                   + " to node " + node.getHost());
-              if (!processSendError(t)) {
-                callback.setError(null, t);
-              }
+              processSendError(t);

Review Comment:
   I meant like that method in the end reaches fetchtoken, and there we are putting appid as null
   Can we not propogate the appId from there and use it here
   ```
     private synchronized void fetchToken() {
       LOG.debug("Trying to fetch a new token...");
       try {
         Token<LlapTokenIdentifier> newToken =
             tokenClient.withCurrentToken(new Token<LlapTokenIdentifier>(token)).getDelegationToken(null); <-- Here, pass appId instead of null
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041218053


##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);
+
+    LOG.info("Initializing periodic token refresh in AM, will run in every {}s", interval);
+    tokenClient = new LlapTokenClient(conf);
+
+    newTokenChecker.scheduleAtFixedRate(() -> {
+      fetchToken();
+    }, 0, interval, TimeUnit.SECONDS);

Review Comment:
   ack, nice catch



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1042221065


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -403,9 +401,8 @@ public void indicateError(Throwable t) {
                   + " appId=" + currentQueryIdentifierProto.getApplicationIdString()
                   + " dagId=" + currentQueryIdentifierProto.getDagIndex()
                   + " to node " + node.getHost());
-              if (!processSendError(t)) {
-                callback.setError(null, t);
-              }
+              processSendError(t);

Review Comment:
   discussed on slack: I haven't touched getDelegationToken API with this patch, appId is of no relevance (it's not even used later)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] ayushtkn commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
ayushtkn commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1040866467


##########
llap-client/src/java/org/apache/hadoop/hive/llap/security/LlapTokenClient.java:
##########
@@ -117,10 +121,72 @@ private Token<LlapTokenIdentifier> extractToken(ByteString tokenBytes) throws IO
 
   private ByteString getTokenBytes(final String appId) throws IOException, ServiceException {
     assert clientInstance != null;
+    if (currentToken != null) {
+      try {
+        return fetchTokenWithCurrentToken(appId);
+      } catch (Exception e) {
+        LOG.error("IOException while getting delgation token, trying with kerberos login", e);

Review Comment:
   How do you know it is an IOE only, you are catching ``Exception`` here, We can have any RuntimeExceptions as well or so.
   I have doubts as well, should we just catch the checked Exceptions like IOE & ServiceException and let any other propagate rather than hiding? some NPE or so will get hidden
   
   Second. Typo. delgation -> delegation
   
   LOG level I think should be warn?



##########
llap-client/src/java/org/apache/hadoop/hive/llap/security/LlapTokenClient.java:
##########
@@ -117,10 +121,72 @@ private Token<LlapTokenIdentifier> extractToken(ByteString tokenBytes) throws IO
 
   private ByteString getTokenBytes(final String appId) throws IOException, ServiceException {
     assert clientInstance != null;
+    if (currentToken != null) {
+      try {
+        return fetchTokenWithCurrentToken(appId);
+      } catch (Exception e) {
+        LOG.error("IOException while getting delgation token, trying with kerberos login", e);
+        return fetchTokenWithKerberosLogin(appId);
+      }
+    } else {
+      LOG.info("currentToken is null, let's try to fetch one with kerberos login");
+      return fetchTokenWithKerberosLogin(appId);
+    }
+  }
+
+  /**
+   * Tries to fetch token by LlapManagementProtocolClientImpl from a daemon on the cluster.
+   * Assumes that we already have a valid currentToken for communicating with the daemons.
+   */
+  private ByteString fetchTokenWithCurrentToken(final String appId) throws IOException, ServiceException {
+    UserGroupInformation ugi = getUgiWithCurrentToken();
+    return getTokenWithUgi(appId, ugi);
+  }
+
+  /**
+   * Tries to fetch token by LlapManagementProtocolClientImpl with a kerberos login.
+   * 1. Logs in to kerberos
+   * 2. Obtains an authenticated ugi
+   * 3. Fetches a delegation token from a deamon.

Review Comment:
   typo deamon -> daemon



##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -584,6 +581,17 @@ public void indicateError(Throwable t) {
         });
   }
 
+  /**
+   * This is a best effort action in case of an invalid LLAP_TOKEN. The communicator (LlapProtocolClientProxy) periodically
+   * refreshes tokens, but there is a relatively small time window (compared to the whole token maxLifetime),
+   * when the token is cancelled and it's not yet fetched from daemons. By the time we detect this problem, the current
+   * task attempt is already failed, but usually there are at least 3 task attempts before failing the task and dag, therefore
+   * fetching an LLAP_TOKEN synchronously here definitely solves the invalid token problem (as the next task attempt will use it).
+   */
+  private void handleInvalidToken(Throwable t) {
+    this.communicator.refreshToken();

Review Comment:
   You don't need the argument ``Throwable t``



##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapServerSecurityInfo.java:
##########
@@ -31,6 +31,9 @@
 public class LlapServerSecurityInfo extends SecurityInfo {
   private static final Logger LOG = LoggerFactory.getLogger(LlapServerSecurityInfo.class);
 
+  public LlapServerSecurityInfo() {
+  }
+

Review Comment:
   why?



##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapTokenSelector.java:
##########
@@ -30,6 +30,9 @@
 public class LlapTokenSelector implements TokenSelector<LlapTokenIdentifier> {
   private static final Logger LOG = LoggerFactory.getLogger(LlapTokenSelector.class);
 
+  public LlapTokenSelector() {
+  }
+

Review Comment:
   Who is using this and the empty constructor above?



##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);
+
+    LOG.info("Initializing periodic token refresh in AM, will run in every {}s", interval);
+    tokenClient = new LlapTokenClient(conf);
+
+    newTokenChecker.scheduleAtFixedRate(() -> {
+      fetchToken();
+    }, 0, interval, TimeUnit.SECONDS);

Review Comment:
   Can use lambda here:
   ```
       newTokenChecker.scheduleAtFixedRate(this::fetchToken, 0, interval, TimeUnit.SECONDS);
   ```



##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);

Review Comment:
   I don't catch this logic.
   Why don't we just use the value ``LLAP_DELEGATION_TOKEN_RENEW_INTERVAL`` configured directly? Why divide by 2 and why are we making the max limit as ```LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS```, why I can't have a bigger number than this? The value of this is also not configurable but hard-coded.
   
   So, can't we give the control to the user conf itself? rather than having our own logics here, and may be if consider in some situations this value isn't correct or too big, we can have some validation checks and throw an exception to make the user configure a correct value?



##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);
+
+    LOG.info("Initializing periodic token refresh in AM, will run in every {}s", interval);
+    tokenClient = new LlapTokenClient(conf);
+
+    newTokenChecker.scheduleAtFixedRate(() -> {
+      fetchToken();
+    }, 0, interval, TimeUnit.SECONDS);
+  }
+
+  private synchronized void fetchToken() {
+    LOG.debug("Trying to fetch a new token...");
+    try {
+      Token<LlapTokenIdentifier> newToken =
+          tokenClient.withCurrentToken(new Token<LlapTokenIdentifier>(token)).getDelegationToken(null);
+      LOG.debug("Received new token: {}, old was: {}", newToken, token);

Review Comment:
   Is logging token safe?



##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -403,9 +401,8 @@ public void indicateError(Throwable t) {
                   + " appId=" + currentQueryIdentifierProto.getApplicationIdString()
                   + " dagId=" + currentQueryIdentifierProto.getDagIndex()
                   + " to node " + node.getHost());
-              if (!processSendError(t)) {
-                callback.setError(null, t);
-              }
+              processSendError(t);

Review Comment:
   We have appId till here, why don't we pass this and use this in ``fetchToken`` instead of passing ``null`` there?



##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -190,31 +173,46 @@ public LlapTaskCommunicator(
     }
   }
 
+  @SuppressWarnings("unchecked")
+  private Token<LlapTokenIdentifier> getLlapToken() {
+    Token<LlapTokenIdentifier> token = null;
+    Credentials credentials = getContext().getAMCredentials();
+    if (credentials != null) {
+      token = (Token<LlapTokenIdentifier>) credentials.getToken(LlapTokenIdentifier.KIND_NAME);
+    }
+    Preconditions.checkState((token != null) == UserGroupInformation.isSecurityEnabled());
+    LOG.info("Task communicator with a token {}", token);

Review Comment:
   The Precondition is pretty deep, took me a second to understand, can of comment telling above, that there should be a token if security is enabled
   BTW. if security is disabled the log line will log the token and as as ``null`` 



##########
llap-server/src/java/org/apache/hadoop/hive/llap/daemon/impl/LlapTokenManager.java:
##########
@@ -0,0 +1,32 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.hive.llap.daemon.impl;
+
+import java.io.IOException;
+
+import org.apache.hadoop.hive.llap.daemon.rpc.LlapDaemonProtocolProtos.GetTokenRequestProto;
+import org.apache.hadoop.hive.llap.security.LlapTokenIdentifier;
+import org.apache.hadoop.security.token.Token;
+
+/**
+ * LlapTokenManager is for renewing and recreating LLAP tokens on a cluster.
+ * See further details in implementations.
+ */
+public interface LlapTokenManager {
+  public static final long LLAP_TOKEN_CHECK_INTERVAL_IN_DEAMON_SECONDS = 300;

Review Comment:
   ```  public static final `` is by default, it isn't required :-) 
   Typo in deamon -> daemon 



##########
llap-server/src/java/org/apache/hadoop/hive/llap/daemon/impl/LlapProtocolServerImpl.java:
##########
@@ -313,6 +311,7 @@ public GetTokenResponseProto getDelegationToken(RpcController controller,
     }
     ByteString bs = ByteString.copyFrom(out.toByteArray());
     GetTokenResponseProto response = GetTokenResponseProto.newBuilder().setToken(bs).build();
+

Review Comment:
   nit: revert not required



##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -190,31 +173,46 @@ public LlapTaskCommunicator(
     }
   }
 
+  @SuppressWarnings("unchecked")
+  private Token<LlapTokenIdentifier> getLlapToken() {
+    Token<LlapTokenIdentifier> token = null;
+    Credentials credentials = getContext().getAMCredentials();
+    if (credentials != null) {
+      token = (Token<LlapTokenIdentifier>) credentials.getToken(LlapTokenIdentifier.KIND_NAME);
+    }
+    Preconditions.checkState((token != null) == UserGroupInformation.isSecurityEnabled());
+    LOG.info("Task communicator with a token {}", token);
+    return token;
+  }
+
   void setScheduler(LlapTaskSchedulerService peer) {
     this.scheduler = peer;
   }
 
   private static final String LLAP_TOKEN_NAME = LlapTokenIdentifier.KIND_NAME.toString();
 
-  /**
-   * @return true iff the error is fatal and we should give up on everything.
-   */
-  private boolean processSendError(Throwable t) {
+  private void processSendError(Throwable t) {
     Throwable cause = t;
     while (cause != null) {
-      if (cause instanceof RetriableException) return false;
-      if (((cause instanceof InvalidToken && cause.getMessage() != null)
-          || (cause instanceof RemoteException && cause.getCause() == null
-              && cause.getMessage() != null && cause.getMessage().contains("InvalidToken")))
-          && cause.getMessage().contains(LLAP_TOKEN_NAME)) {
-        break;
+      if (isInvalidTokenError(cause)) {
+        handleInvalidToken(cause);
+        return;
       }
       cause = cause.getCause();
     }
-    if (cause == null) return false;
-    LOG.error("Reporting fatal error - LLAP token appears to be invalid.", t);
-    getContext().reportError(ServicePluginErrorDefaults.OTHER_FATAL, cause.getMessage(), null);
-    return true;
+  }
+
+  private boolean isInvalidTokenError(Throwable cause) {
+    LOG.debug("Checking for invalid token error, cause: {}, cause.getCause(): {}", cause, cause.getCause());
+    /*
+     * The lastest message discovered (while doing HIVE-26569) for a RemoteException is:
+     * "Current (LLAP_TOKEN; LLAP_TOKEN owner=hive/***, renewer=hive, realUser=, issueDate=1670317803579, maxDate=1671527403579,
+     * sequenceNumber=297, masterKeyId=296, cluster ***, app ID , signing false) can't be found in cache"
+     */
+    return cause.getMessage().contains(LLAP_TOKEN_NAME)

Review Comment:
   can ``cause.getMessage`` be ``null`` in any case? if so better we have a ``null`` check



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041231532


##########
llap-server/src/java/org/apache/hadoop/hive/llap/daemon/impl/LlapTokenManager.java:
##########
@@ -0,0 +1,32 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.hive.llap.daemon.impl;
+
+import java.io.IOException;
+
+import org.apache.hadoop.hive.llap.daemon.rpc.LlapDaemonProtocolProtos.GetTokenRequestProto;
+import org.apache.hadoop.hive.llap.security.LlapTokenIdentifier;
+import org.apache.hadoop.security.token.Token;
+
+/**
+ * LlapTokenManager is for renewing and recreating LLAP tokens on a cluster.
+ * See further details in implementations.
+ */
+public interface LlapTokenManager {
+  public static final long LLAP_TOKEN_CHECK_INTERVAL_IN_DEAMON_SECONDS = 300;

Review Comment:
   ack



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1341625960

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [29 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] github-actions[bot] closed pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
github-actions[bot] closed pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs
URL: https://github.com/apache/hive/pull/3626


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041229232


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -190,31 +173,46 @@ public LlapTaskCommunicator(
     }
   }
 
+  @SuppressWarnings("unchecked")
+  private Token<LlapTokenIdentifier> getLlapToken() {
+    Token<LlapTokenIdentifier> token = null;
+    Credentials credentials = getContext().getAMCredentials();
+    if (credentials != null) {
+      token = (Token<LlapTokenIdentifier>) credentials.getToken(LlapTokenIdentifier.KIND_NAME);
+    }
+    Preconditions.checkState((token != null) == UserGroupInformation.isSecurityEnabled());
+    LOG.info("Task communicator with a token {}", token);
+    return token;
+  }
+
   void setScheduler(LlapTaskSchedulerService peer) {
     this.scheduler = peer;
   }
 
   private static final String LLAP_TOKEN_NAME = LlapTokenIdentifier.KIND_NAME.toString();
 
-  /**
-   * @return true iff the error is fatal and we should give up on everything.
-   */
-  private boolean processSendError(Throwable t) {
+  private void processSendError(Throwable t) {
     Throwable cause = t;
     while (cause != null) {
-      if (cause instanceof RetriableException) return false;
-      if (((cause instanceof InvalidToken && cause.getMessage() != null)
-          || (cause instanceof RemoteException && cause.getCause() == null
-              && cause.getMessage() != null && cause.getMessage().contains("InvalidToken")))
-          && cause.getMessage().contains(LLAP_TOKEN_NAME)) {
-        break;
+      if (isInvalidTokenError(cause)) {
+        handleInvalidToken(cause);
+        return;
       }
       cause = cause.getCause();
     }
-    if (cause == null) return false;
-    LOG.error("Reporting fatal error - LLAP token appears to be invalid.", t);
-    getContext().reportError(ServicePluginErrorDefaults.OTHER_FATAL, cause.getMessage(), null);
-    return true;
+  }
+
+  private boolean isInvalidTokenError(Throwable cause) {
+    LOG.debug("Checking for invalid token error, cause: {}, cause.getCause(): {}", cause, cause.getCause());
+    /*
+     * The lastest message discovered (while doing HIVE-26569) for a RemoteException is:
+     * "Current (LLAP_TOKEN; LLAP_TOKEN owner=hive/***, renewer=hive, realUser=, issueDate=1670317803579, maxDate=1671527403579,
+     * sequenceNumber=297, masterKeyId=296, cluster ***, app ID , signing false) can't be found in cache"
+     */
+    return cause.getMessage().contains(LLAP_TOKEN_NAME)

Review Comment:
   it's checked later in this epic condition, I'm changing order to have null check first:
   ```
   cause.getMessage() != null
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041242965


##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapTokenSelector.java:
##########
@@ -30,6 +30,9 @@
 public class LlapTokenSelector implements TokenSelector<LlapTokenIdentifier> {
   private static final Logger LOG = LoggerFactory.getLogger(LlapTokenSelector.class);
 
+  public LlapTokenSelector() {
+  }
+

Review Comment:
   maybe leftover, I remember I needed it for making TOKEN auth work (reflection stuff in hadoop maybe), but now I cannot find any proof in hadoop code that it's needed LOL
   I'm testing without the constructor, if it works, I'll remove, if it's needed, I'll put code comment



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041230117


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -190,31 +173,46 @@ public LlapTaskCommunicator(
     }
   }
 
+  @SuppressWarnings("unchecked")
+  private Token<LlapTokenIdentifier> getLlapToken() {
+    Token<LlapTokenIdentifier> token = null;
+    Credentials credentials = getContext().getAMCredentials();
+    if (credentials != null) {
+      token = (Token<LlapTokenIdentifier>) credentials.getToken(LlapTokenIdentifier.KIND_NAME);
+    }
+    Preconditions.checkState((token != null) == UserGroupInformation.isSecurityEnabled());
+    LOG.info("Task communicator with a token {}", token);

Review Comment:
   agree, putting a comment + null check for the log line
   ```
   // supposed to have a token only if security is enabled (any mismatch here implies a configuration problem)
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041223925


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -403,9 +401,8 @@ public void indicateError(Throwable t) {
                   + " appId=" + currentQueryIdentifierProto.getApplicationIdString()
                   + " dagId=" + currentQueryIdentifierProto.getDagIndex()
                   + " to node " + node.getHost());
-              if (!processSendError(t)) {
-                callback.setError(null, t);
-              }
+              processSendError(t);

Review Comment:
   sorry, I don't get this one, I cannot find the connection between the marked line and appId



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041243821


##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapServerSecurityInfo.java:
##########
@@ -31,6 +31,9 @@
 public class LlapServerSecurityInfo extends SecurityInfo {
   private static final Logger LOG = LoggerFactory.getLogger(LlapServerSecurityInfo.class);
 
+  public LlapServerSecurityInfo() {
+  }
+

Review Comment:
   the very same as LlapTokenSelector



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1042207296


##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapServerSecurityInfo.java:
##########
@@ -31,6 +31,9 @@
 public class LlapServerSecurityInfo extends SecurityInfo {
   private static final Logger LOG = LoggerFactory.getLogger(LlapServerSecurityInfo.class);
 
+  public LlapServerSecurityInfo() {
+  }
+

Review Comment:
   checked, it's not needed, removing



##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapTokenSelector.java:
##########
@@ -30,6 +30,9 @@
 public class LlapTokenSelector implements TokenSelector<LlapTokenIdentifier> {
   private static final Logger LOG = LoggerFactory.getLogger(LlapTokenSelector.class);
 
+  public LlapTokenSelector() {
+  }
+

Review Comment:
   checked, it's not needed, removing



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1042205765


##########
llap-common/src/java/org/apache/hadoop/hive/llap/security/LlapTokenSelector.java:
##########
@@ -30,6 +30,9 @@
 public class LlapTokenSelector implements TokenSelector<LlapTokenIdentifier> {
   private static final Logger LOG = LoggerFactory.getLogger(LlapTokenSelector.class);
 
+  public LlapTokenSelector() {
+  }
+

Review Comment:
   checked, it's not needed, removing



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1339681713

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [25 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041237612


##########
llap-client/src/java/org/apache/hadoop/hive/llap/security/LlapTokenClient.java:
##########
@@ -117,10 +121,72 @@ private Token<LlapTokenIdentifier> extractToken(ByteString tokenBytes) throws IO
 
   private ByteString getTokenBytes(final String appId) throws IOException, ServiceException {
     assert clientInstance != null;
+    if (currentToken != null) {
+      try {
+        return fetchTokenWithCurrentToken(appId);
+      } catch (Exception e) {
+        LOG.error("IOException while getting delgation token, trying with kerberos login", e);

Review Comment:
   I agree, actually I'm targeting IOException and ServiceException here, I'm about to narrow the scope
   if any other problem (exception type) comes here later that can be solved with kerberos re-login, we can add it
   
   fixing typo



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041040101


##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);
+
+    LOG.info("Initializing periodic token refresh in AM, will run in every {}s", interval);
+    tokenClient = new LlapTokenClient(conf);
+
+    newTokenChecker.scheduleAtFixedRate(() -> {
+      fetchToken();
+    }, 0, interval, TimeUnit.SECONDS);
+  }
+
+  private synchronized void fetchToken() {
+    LOG.debug("Trying to fetch a new token...");
+    try {
+      Token<LlapTokenIdentifier> newToken =
+          tokenClient.withCurrentToken(new Token<LlapTokenIdentifier>(token)).getDelegationToken(null);
+      LOG.debug("Received new token: {}, old was: {}", newToken, token);

Review Comment:
   yes, it logs only public info about tokens by design, like:
   ```
    token (LLAP_TOKEN; LLAP_TOKEN owner=hive/dwx-env-cdp-ati-c612-env-1@ROOT.HWX.SITE, renewer=hive, realUser=, issueDate=1663838461176, maxDate=1663838521176, sequenceNumber=18, masterKeyId=18, cluster hive_compute-hive-lbodor, app ID , signing false)
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1342311278

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [19 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog merged pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog merged PR #3626:
URL: https://github.com/apache/hive/pull/3626


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1259408974

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [14 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] github-actions[bot] commented on pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1328381444

   This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
   Feel free to reach out on the dev@hive.apache.org list if the patch is in need of reviews.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1337077515

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [7 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041219149


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -584,6 +581,17 @@ public void indicateError(Throwable t) {
         });
   }
 
+  /**
+   * This is a best effort action in case of an invalid LLAP_TOKEN. The communicator (LlapProtocolClientProxy) periodically
+   * refreshes tokens, but there is a relatively small time window (compared to the whole token maxLifetime),
+   * when the token is cancelled and it's not yet fetched from daemons. By the time we detect this problem, the current
+   * task attempt is already failed, but usually there are at least 3 task attempts before failing the task and dag, therefore
+   * fetching an LLAP_TOKEN synchronously here definitely solves the invalid token problem (as the next task attempt will use it).
+   */
+  private void handleInvalidToken(Throwable t) {
+    this.communicator.refreshToken();

Review Comment:
   ack, it's just a leftover



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: LlapTokenRenewer: TezAM (LlapTaskCommunicator) to renew LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1259785483

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [14 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041203596


##########
llap-client/src/java/org/apache/hadoop/hive/llap/security/LlapTokenClient.java:
##########
@@ -117,10 +121,72 @@ private Token<LlapTokenIdentifier> extractToken(ByteString tokenBytes) throws IO
 
   private ByteString getTokenBytes(final String appId) throws IOException, ServiceException {
     assert clientInstance != null;
+    if (currentToken != null) {
+      try {
+        return fetchTokenWithCurrentToken(appId);
+      } catch (Exception e) {
+        LOG.error("IOException while getting delgation token, trying with kerberos login", e);
+        return fetchTokenWithKerberosLogin(appId);
+      }
+    } else {
+      LOG.info("currentToken is null, let's try to fetch one with kerberos login");
+      return fetchTokenWithKerberosLogin(appId);
+    }
+  }
+
+  /**
+   * Tries to fetch token by LlapManagementProtocolClientImpl from a daemon on the cluster.
+   * Assumes that we already have a valid currentToken for communicating with the daemons.
+   */
+  private ByteString fetchTokenWithCurrentToken(final String appId) throws IOException, ServiceException {
+    UserGroupInformation ugi = getUgiWithCurrentToken();
+    return getTokenWithUgi(appId, ugi);
+  }
+
+  /**
+   * Tries to fetch token by LlapManagementProtocolClientImpl with a kerberos login.
+   * 1. Logs in to kerberos
+   * 2. Obtains an authenticated ugi
+   * 3. Fetches a delegation token from a deamon.

Review Comment:
   ack



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1339182013

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![B](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/B-16px.png 'B')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [2 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [25 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1041230117


##########
llap-tez/src/java/org/apache/hadoop/hive/llap/tezplugins/LlapTaskCommunicator.java:
##########
@@ -190,31 +173,46 @@ public LlapTaskCommunicator(
     }
   }
 
+  @SuppressWarnings("unchecked")
+  private Token<LlapTokenIdentifier> getLlapToken() {
+    Token<LlapTokenIdentifier> token = null;
+    Credentials credentials = getContext().getAMCredentials();
+    if (credentials != null) {
+      token = (Token<LlapTokenIdentifier>) credentials.getToken(LlapTokenIdentifier.KIND_NAME);
+    }
+    Preconditions.checkState((token != null) == UserGroupInformation.isSecurityEnabled());
+    LOG.info("Task communicator with a token {}", token);

Review Comment:
   agree, putting a comment:
   ```
   // supposed to have a token only if security is enabled (any mismatch here implies a configuration problem)
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] sonarcloud[bot] commented on pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #3626:
URL: https://github.com/apache/hive/pull/3626#issuecomment-1341855377

   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=3626)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=3626&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL) [19 Code Smells](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=3626&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=coverage&view=list) No Coverage information  
   [![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=3626&metric=duplicated_lines_density&view=list) No Duplication information
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org

[GitHub] [hive] abstractdog commented on a diff in pull request #3626: HIVE-26569: Support renewal and recreation of LLAP_TOKENs

Posted by GitBox <gi...@apache.org>.
abstractdog commented on code in PR #3626:
URL: https://github.com/apache/hive/pull/3626#discussion_r1042134071


##########
llap-client/src/java/org/apache/hadoop/hive/llap/tez/LlapProtocolClientProxy.java:
##########
@@ -94,6 +105,35 @@ public void sendUpdateFragment(final UpdateFragmentRequestProto request, final S
     queueRequest(new SendUpdateFragmentCallable(nodeId, request, callback));
   }
 
+  protected void initPeriodicTokenRefresh(Configuration conf) {
+    if (!UserGroupInformation.isSecurityEnabled()) {
+      return;
+    }
+    long tokenRenewInterval =
+        HiveConf.getTimeVar(conf, ConfVars.LLAP_DELEGATION_TOKEN_RENEW_INTERVAL, TimeUnit.SECONDS);
+    // if the tokenRenewInterval is low (e.g. testing), let's use the half of it as interval instead of the constant
+    long interval = Math.min(tokenRenewInterval / 2, LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS);

Review Comment:
   you know what, I'm removing this logic altogether and using LLAP_TOKEN_REFRESH_INTERVAL_IN_AM_SECONDS
   let's keep this simple



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org