[GitHub] walterddr opened a new pull request #7702: [FLINK-11088][Security][YARN] Allow YARN to discover pre-installed keytab files

[GitBox <gi...@apache.org>]

walterddr opened a new pull request #7702: [FLINK-11088][Security][YARN] Allow YARN to discover pre-installed keytab files
URL: https://github.com/apache/flink/pull/7702
 
 
   ## What is the purpose of the change
   
   * This PR introduces two new configuration keys in the YARN configuration to allow Flink to load pre-installed Kerberos keytab files directly from local file system instead of having to have Flink client upload Kerberos keytab files through Yarn local resource bucket.
   
   
   ## Brief change log
   
     - Added two new key with default values 
       - `yarn.security.kerberos.keytab.path` which defaults to local resource bucket: `krb.keytab`
       - `yarn.security.kerberos.require.localize.keytab` which defaults to true. If set to false, Flink will not upload the client keytab used in its own section to YARN local resource bucket. Instead, whatever path configured in `yarn.security.kerberos.keytab.path` will be used.
     - Changed AbstractYarnClusterDescriptor to conform with 2 options above.
     - Changed the YarnTaskExecutorRunner to load keytab configurations differently according to 2 options above.
   
   
   ## Verifying this change
   
   This change is already covered by existing tests in `flink-yarn-test` component.
   
   This change also added tests 
     - added additional test config parsing in YarnTaskExecutorRunnerTest.
     - Modified YARNSessionFIFOITCase and YARNSessionFIFOSecuredITCase to allow dynamic properties loading during test sections.
     - Added specific section for pre-installed YARN Kerberos keytab file.
   
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): no
     - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
     - The serializers: no
     - The runtime per-record code paths (performance sensitive): no
     - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Yarn/Mesos, ZooKeeper: yes
     - The S3 file system connector: no
   
   ## Documentation
   
     - Does this pull request introduce a new feature? yes
     - If yes, how is the feature documented? document regenerated
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services