You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "K0K0V0K (via GitHub)" <gi...@apache.org> on 2026/02/24 12:46:23 UTC
[PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
K0K0V0K opened a new pull request, #8273:
URL: https://github.com/apache/hadoop/pull/8273
### Description of PR
YARN web proxy not forwards hadoop-jwt token.
So if we
- have a YARN application (lets say spark)
- and we check the RM UI2 via KNOX proxy
- and we click the ApplicationMaster link on the application page of the spark app
The browser will be forwarded to the SparkAM ui
for example: /gateway/cdp-proxy/yarnuiv2/proxy/application_1771935206205_0001/
SparkAM wont receive the hadoop-jwt cookie, so will ask user to login.
Instead of this if we can pass the jwt cookie for the AM so the user can see the AM UI after login state, and wont need to login again.
Security NOTE:
If user clicks on a non trusted application AM UI then the jwt token may leak, but i dont think that is a valid case that non trusted application is running on a cluster.
### How was this patch tested?
Manually created a cluster with spark and knox, and checked the token will be forwarded.
UT was created.
### For code changes:
- [ ] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, `NOTICE-binary` files?
### AI Tooling
No AI was used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "K0K0V0K (via GitHub)" <gi...@apache.org>.
K0K0V0K commented on code in PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#discussion_r2851339233
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/ProxyUtils.java:
##########
@@ -122,4 +127,40 @@ public static void rejectNonHttpRequests(ServletRequest req) throws
throw new ServletException(E_HTTP_HTTPS_ONLY);
}
}
+
+ /**
+ * Returns the value of a cookie with the given name from the HTTP servlet request.
+ * Cookie name comparison is case-insensitive. If the request contains no cookies
+ * or the specified cookie is not present, this method returns {@code null}.
+ *
+ * @param req the HTTP servlet request containing cookies
+ * @param cookieName the name of the cookie to retrieve
+ * @return the cookie value, or {@code null} if not found
+ */
+ public static String getCookie(HttpServletRequest req, String cookieName) {
+ Cookie[] cookies = req.getCookies();
Review Comment:
Thanks @susheelgupta7 for pointing this out.
Currently, this method is only called once, with a jwtCookieName that most likely has the value "hadoop-jwt". Given this, adding a null check here would probably just introduce unnecessary noise into the code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "brumi1024 (via GitHub)" <gi...@apache.org>.
brumi1024 commented on code in PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#discussion_r2853231365
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/ProxyUtils.java:
##########
@@ -122,4 +129,43 @@ public static void rejectNonHttpRequests(ServletRequest req) throws
throw new ServletException(E_HTTP_HTTPS_ONLY);
}
}
+
+ /**
+ * Returns the value of a cookie with the given name from the HTTP servlet request.
+ * Cookie name comparison is case-insensitive. If the request contains no cookies
+ * or the specified cookie is not present, this method returns {@code null}.
+ *
+ * @param req the HTTP servlet request containing cookies
+ * @param cookieName the name of the cookie to retrieve
+ * @return the cookie value, or {@code null} if not found or cookieName is blank
+ */
+ public static String getCookie(HttpServletRequest req, String cookieName) {
+ Cookie[] cookies = req.getCookies();
+ if (cookies != null && StringUtils.isNotBlank(cookieName)) {
+ for (Cookie cookie : cookies) {
+ if (cookieName.equals(cookie.getName())) {
+ return cookie.getValue();
+ }
+ }
+ }
+ return null;
+ }
+
+ /**
+ * Sets the {@code Cookie} header on the given HTTP request using the provided cookies.
+ * Cookies are formatted according to the standard HTTP header syntax:
+ * {@code name=value; name2=value2}.
+ *
+ * @param req the HTTP request on which to set the cookie header
+ * @param cookies a map of cookie names to cookie values
+ */
+ public static void setCookies(HttpRequestBase req, Map<String, String> cookies) {
+ if (MapUtils.isEmpty(cookies)) {
Review Comment:
Nit: this is an implicit dependency (through hadoop-commons), questionable if it's worth it. A simple `if (cookies == null || cookies.isEmpty())` should suffice, without the need of an extra import.
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java:
##########
@@ -2846,6 +2846,10 @@ public static boolean isAclEnabled(Configuration conf) {
public static final int DEFAULT_RM_PROXY_CONNECTION_TIMEOUT =
60000;
+ public static final String RM_PROXY_JWT_FORWARD_ENABLED = RM_PREFIX + "proxy.jwt-forward.enabled";
+
+ public static final boolean DEFAULT_RM_PROXY_JWT_FORWARD_ENABLED = true;
Review Comment:
I think this should be opt-in rather than opt-out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "hadoop-yetus (via GitHub)" <gi...@apache.org>.
hadoop-yetus commented on PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#issuecomment-3953271505
:broken_heart: **-1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 38s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 1s | | No case conflicting files found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available. |
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain any @author tags. |
| +1 :green_heart: | test4tests | 0m 0s | | The patch appears to include 1 new or modified test files. |
|||| _ trunk Compile Tests _ |
| +0 :ok: | mvndep | 2m 8s | | Maven dependency ordering for branch |
| +1 :green_heart: | mvninstall | 45m 51s | | trunk passed |
| +1 :green_heart: | compile | 16m 47s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | compile | 16m 35s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | checkstyle | 5m 38s | | trunk passed |
| +1 :green_heart: | mvnsite | 1m 50s | | trunk passed |
| +1 :green_heart: | javadoc | 1m 51s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javadoc | 1m 45s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | spotbugs | 2m 8s | | trunk passed |
| +1 :green_heart: | shadedclient | 30m 37s | | branch has no errors when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +0 :ok: | mvndep | 0m 32s | | Maven dependency ordering for patch |
| +1 :green_heart: | mvninstall | 0m 46s | | the patch passed |
| +1 :green_heart: | compile | 15m 29s | | the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javac | 15m 29s | | the patch passed |
| +1 :green_heart: | compile | 16m 38s | | the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | javac | 16m 38s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks issues. |
| -0 :warning: | checkstyle | 5m 34s | [/results-checkstyle-root.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/results-checkstyle-root.txt) | root: The patch generated 5 new + 17 unchanged - 1 fixed = 22 total (was 18) |
| +1 :green_heart: | mvnsite | 1m 53s | | the patch passed |
| -1 :x: | javadoc | 0m 54s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 1 new + 71 unchanged - 0 fixed = 72 total (was 71) |
| -1 :x: | javadoc | 0m 53s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 3 new + 78 unchanged - 0 fixed = 81 total (was 78) |
| -1 :x: | javadoc | 0m 53s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 1 new + 58 unchanged - 0 fixed = 59 total (was 58) |
| -1 :x: | javadoc | 0m 52s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 3 new + 73 unchanged - 0 fixed = 76 total (was 73) |
| +1 :green_heart: | spotbugs | 2m 42s | | the patch passed |
| +1 :green_heart: | shadedclient | 28m 34s | | patch has no errors when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 3m 45s | | hadoop-auth in the patch passed. |
| +1 :green_heart: | unit | 2m 0s | | hadoop-yarn-server-web-proxy in the patch passed. |
| +1 :green_heart: | asflicense | 1m 15s | | The patch does not generate ASF License warnings. |
| | | 217m 8s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.53 ServerAPI=1.53 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/artifact/out/Dockerfile |
| GITHUB PR | https://github.com/apache/hadoop/pull/8273 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets |
| uname | Linux 38e0ddc53ea7 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / 521aff4f75a2481cc4da5c7c4c0a298864bd1df4 |
| Default Java | Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Multi-JDK versions | /usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/testReport/ |
| Max. process+thread count | 639 (vs. ulimit of 5500) |
| modules | C: hadoop-common-project/hadoop-auth hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy U: . |
| Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/1/console |
| versions | git=2.43.0 maven=3.9.11 spotbugs=4.9.7 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "brumi1024 (via GitHub)" <gi...@apache.org>.
brumi1024 commented on code in PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#discussion_r2852879109
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/WebAppProxyServlet.java:
##########
@@ -311,11 +321,19 @@ private void proxyLink(final HttpServletRequest req,
}
}
+ Map<String, String> cookies = new HashMap<>();
String user = req.getRemoteUser();
- if (user != null && !user.isEmpty()) {
- base.setHeader("Cookie",
- PROXY_USER_COOKIE_NAME + "=" + URLEncoder.encode(user, "ASCII"));
+ if (StringUtils.hasLength(user)) {
+ LOG.debug("Cookie {} will be set", PROXY_USER_COOKIE_NAME);
+ cookies.put(PROXY_USER_COOKIE_NAME, URLEncoder.encode(user, "ASCII"));
+ }
+ String jwtCookie = getCookie(req, jwtCookieName);
+ if (StringUtils.hasLength(jwtCookie)) {
+ LOG.debug("Cookie {} will be set", jwtCookieName);
+ cookies.put(jwtCookieName, jwtCookie);
}
+ setCookies(base, cookies);
Review Comment:
Small regression: previously we only set the cookies if the user wasn't empty or null. Now if the cookies map is an empty HashMap we simply write an empty string to the Cookies header. Probably a similar empty check should be called here as well.
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/WebAppProxyServlet.java:
##########
@@ -311,11 +321,19 @@ private void proxyLink(final HttpServletRequest req,
}
}
+ Map<String, String> cookies = new HashMap<>();
String user = req.getRemoteUser();
- if (user != null && !user.isEmpty()) {
- base.setHeader("Cookie",
- PROXY_USER_COOKIE_NAME + "=" + URLEncoder.encode(user, "ASCII"));
+ if (StringUtils.hasLength(user)) {
+ LOG.debug("Cookie {} will be set", PROXY_USER_COOKIE_NAME);
+ cookies.put(PROXY_USER_COOKIE_NAME, URLEncoder.encode(user, "ASCII"));
Review Comment:
Nit: StandardCharsets.US_ASCII could be used instead of the literal.
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/ProxyUtils.java:
##########
@@ -122,4 +127,40 @@ public static void rejectNonHttpRequests(ServletRequest req) throws
throw new ServletException(E_HTTP_HTTPS_ONLY);
}
}
+
+ /**
+ * Returns the value of a cookie with the given name from the HTTP servlet request.
+ * Cookie name comparison is case-insensitive. If the request contains no cookies
+ * or the specified cookie is not present, this method returns {@code null}.
+ *
+ * @param req the HTTP servlet request containing cookies
+ * @param cookieName the name of the cookie to retrieve
+ * @return the cookie value, or {@code null} if not found
+ */
+ public static String getCookie(HttpServletRequest req, String cookieName) {
+ Cookie[] cookies = req.getCookies();
+ if (cookies != null) {
+ for (Cookie cookie : cookies) {
+ if (cookieName.equalsIgnoreCase(cookie.getName())) {
Review Comment:
Nit: why equalsIgnoreCase? Cookie names are case-sensitive, and JWTRedirectAuthenticationHandler.getJWTFromCookie uses `cookieName.equals(cookie.getName()`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "susheelgupta7 (via GitHub)" <gi...@apache.org>.
susheelgupta7 commented on code in PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#discussion_r2850698568
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/ProxyUtils.java:
##########
@@ -122,4 +127,40 @@ public static void rejectNonHttpRequests(ServletRequest req) throws
throw new ServletException(E_HTTP_HTTPS_ONLY);
}
}
+
+ /**
+ * Returns the value of a cookie with the given name from the HTTP servlet request.
+ * Cookie name comparison is case-insensitive. If the request contains no cookies
+ * or the specified cookie is not present, this method returns {@code null}.
+ *
+ * @param req the HTTP servlet request containing cookies
+ * @param cookieName the name of the cookie to retrieve
+ * @return the cookie value, or {@code null} if not found
+ */
+ public static String getCookie(HttpServletRequest req, String cookieName) {
+ Cookie[] cookies = req.getCookies();
Review Comment:
Do we need to add validation if cookieName is null ??
Apart from this everything looks good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "K0K0V0K (via GitHub)" <gi...@apache.org>.
K0K0V0K closed pull request #8273: YARN-11937. Forward hadoop-jwt with YARN proxy
URL: https://github.com/apache/hadoop/pull/8273
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "hadoop-yetus (via GitHub)" <gi...@apache.org>.
hadoop-yetus commented on PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#issuecomment-3960389847
:broken_heart: **-1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 22s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available. |
| +0 :ok: | xmllint | 0m 0s | | xmllint was not available. |
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain any @author tags. |
| +1 :green_heart: | test4tests | 0m 0s | | The patch appears to include 1 new or modified test files. |
|||| _ trunk Compile Tests _ |
| +0 :ok: | mvndep | 2m 2s | | Maven dependency ordering for branch |
| +1 :green_heart: | mvninstall | 29m 43s | | trunk passed |
| +1 :green_heart: | compile | 9m 32s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | compile | 9m 55s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | checkstyle | 3m 13s | | trunk passed |
| +1 :green_heart: | mvnsite | 2m 17s | | trunk passed |
| +1 :green_heart: | javadoc | 2m 29s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javadoc | 2m 16s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | spotbugs | 4m 25s | | trunk passed |
| +1 :green_heart: | shadedclient | 17m 0s | | branch has no errors when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +0 :ok: | mvndep | 0m 17s | | Maven dependency ordering for patch |
| +1 :green_heart: | mvninstall | 1m 19s | | the patch passed |
| +1 :green_heart: | compile | 8m 7s | | the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javac | 8m 7s | | the patch passed |
| +1 :green_heart: | compile | 8m 52s | | the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | javac | 8m 52s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks issues. |
| +1 :green_heart: | checkstyle | 3m 9s | | root: The patch generated 0 new + 181 unchanged - 1 fixed = 181 total (was 182) |
| +1 :green_heart: | mvnsite | 2m 34s | | the patch passed |
| -1 :x: | javadoc | 0m 34s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 1 new + 71 unchanged - 0 fixed = 72 total (was 71) |
| -1 :x: | javadoc | 0m 33s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 1 new + 78 unchanged - 0 fixed = 79 total (was 78) |
| -1 :x: | javadoc | 0m 33s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 1 new + 58 unchanged - 0 fixed = 59 total (was 58) |
| -1 :x: | javadoc | 0m 34s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 1 new + 73 unchanged - 0 fixed = 74 total (was 73) |
| +1 :green_heart: | spotbugs | 4m 56s | | the patch passed |
| +1 :green_heart: | shadedclient | 16m 10s | | patch has no errors when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 3m 8s | | hadoop-auth in the patch passed. |
| +1 :green_heart: | unit | 0m 53s | | hadoop-yarn-api in the patch passed. |
| +1 :green_heart: | unit | 4m 33s | | hadoop-yarn-common in the patch passed. |
| +1 :green_heart: | unit | 1m 25s | | hadoop-yarn-server-web-proxy in the patch passed. |
| +1 :green_heart: | asflicense | 0m 47s | | The patch does not generate ASF License warnings. |
| | | 151m 0s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.53 ServerAPI=1.53 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/artifact/out/Dockerfile |
| GITHUB PR | https://github.com/apache/hadoop/pull/8273 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets xmllint |
| uname | Linux 2ef6575832dc 5.15.0-141-generic #151-Ubuntu SMP Sun May 18 21:35:19 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / 54235956163e07a4cff903ef3dccef974727fc74 |
| Default Java | Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Multi-JDK versions | /usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/testReport/ |
| Max. process+thread count | 614 (vs. ulimit of 5500) |
| modules | C: hadoop-common-project/hadoop-auth hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy U: . |
| Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/3/console |
| versions | git=2.43.0 maven=3.9.11 spotbugs=4.9.7 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "K0K0V0K (via GitHub)" <gi...@apache.org>.
K0K0V0K commented on PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#issuecomment-3959513617
I think this feature would be to much security risk even if we disable by default.
I am closing the ticket and the PR.
Thanks @brumi1024 @susheelgupta7 @p-szucs for the review!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "hadoop-yetus (via GitHub)" <gi...@apache.org>.
hadoop-yetus commented on PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#issuecomment-3954976786
:broken_heart: **-1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 38s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available. |
| +1 :green_heart: | @author | 0m 1s | | The patch does not contain any @author tags. |
| +1 :green_heart: | test4tests | 0m 0s | | The patch appears to include 1 new or modified test files. |
|||| _ trunk Compile Tests _ |
| +0 :ok: | mvndep | 2m 39s | | Maven dependency ordering for branch |
| +1 :green_heart: | mvninstall | 45m 1s | | trunk passed |
| +1 :green_heart: | compile | 15m 52s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | compile | 16m 17s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | checkstyle | 5m 26s | | trunk passed |
| +1 :green_heart: | mvnsite | 1m 49s | | trunk passed |
| +1 :green_heart: | javadoc | 1m 50s | | trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javadoc | 1m 46s | | trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | spotbugs | 2m 16s | | trunk passed |
| +1 :green_heart: | shadedclient | 28m 15s | | branch has no errors when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +0 :ok: | mvndep | 0m 30s | | Maven dependency ordering for patch |
| +1 :green_heart: | mvninstall | 0m 43s | | the patch passed |
| +1 :green_heart: | compile | 15m 26s | | the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 |
| +1 :green_heart: | javac | 15m 26s | | the patch passed |
| +1 :green_heart: | compile | 17m 18s | | the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| +1 :green_heart: | javac | 17m 18s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks issues. |
| +1 :green_heart: | checkstyle | 5m 26s | | root: The patch generated 0 new + 17 unchanged - 1 fixed = 17 total (was 18) |
| +1 :green_heart: | mvnsite | 1m 51s | | the patch passed |
| -1 :x: | javadoc | 0m 54s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 1 new + 71 unchanged - 0 fixed = 72 total (was 71) |
| -1 :x: | javadoc | 0m 53s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-21.0.10+7-Ubuntu-124.04 with JDK Ubuntu-21.0.10+7-Ubuntu-124.04 generated 1 new + 78 unchanged - 0 fixed = 79 total (was 78) |
| -1 :x: | javadoc | 0m 54s | [/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/artifact/out/results-javadoc-javadoc-hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-common-project_hadoop-auth-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 1 new + 58 unchanged - 0 fixed = 59 total (was 58) |
| -1 :x: | javadoc | 0m 52s | [/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/artifact/out/results-javadoc-javadoc-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt) | hadoop-yarn-project_hadoop-yarn_hadoop-yarn-server_hadoop-yarn-server-web-proxy-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1 with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1 generated 1 new + 73 unchanged - 0 fixed = 74 total (was 73) |
| +1 :green_heart: | spotbugs | 2m 41s | | the patch passed |
| +1 :green_heart: | shadedclient | 28m 42s | | patch has no errors when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 3m 45s | | hadoop-auth in the patch passed. |
| +1 :green_heart: | unit | 1m 58s | | hadoop-yarn-server-web-proxy in the patch passed. |
| +1 :green_heart: | asflicense | 1m 14s | | The patch does not generate ASF License warnings. |
| | | 213m 23s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.53 ServerAPI=1.53 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/artifact/out/Dockerfile |
| GITHUB PR | https://github.com/apache/hadoop/pull/8273 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets |
| uname | Linux cf144e050e0d 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / a0ba848c8a5d0f86267aaaa6133847a9a878ad36 |
| Default Java | Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Multi-JDK versions | /usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1 |
| Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/testReport/ |
| Max. process+thread count | 634 (vs. ulimit of 5500) |
| modules | C: hadoop-common-project/hadoop-auth hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy U: . |
| Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8273/2/console |
| versions | git=2.43.0 maven=3.9.11 spotbugs=4.9.7 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11937. Forward hadoop-jwt with YARN proxy [hadoop]
Posted by "K0K0V0K (via GitHub)" <gi...@apache.org>.
K0K0V0K commented on PR #8273:
URL: https://github.com/apache/hadoop/pull/8273#issuecomment-3959344640
Thanks @brumi1024 for the review.
I modified the PR based on that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org