You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "Shawn Weeks (JIRA)" <ji...@apache.org> on 2019/03/16 16:56:00 UTC
[jira] [Commented] (YARN-7907) Yarn app CLI client does not send
Kerberos header to Resource Manager rest API
[ https://issues.apache.org/jira/browse/YARN-7907?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16794310#comment-16794310 ]
Shawn Weeks commented on YARN-7907:
-----------------------------------
And a third reason this can happen since this is the first post Google finds. Check to make sure -Djava.security.auth.login.config isn't getting set to yarn_jaas.conf. Some Hortonworks distributions are incorrectly setting this and it leads to all the yarn app commands trying to authenticate as [rm/_HOST@DOMAIN.COM|mailto:rm/_HOST@DOMAIN.COM]. Oddly enough having #2 above set doesn't seem to break things.
> Yarn app CLI client does not send Kerberos header to Resource Manager rest API
> ------------------------------------------------------------------------------
>
> Key: YARN-7907
> URL: https://issues.apache.org/jira/browse/YARN-7907
> Project: Hadoop YARN
> Issue Type: Bug
> Components: yarn-native-services
> Affects Versions: 3.0.0
> Reporter: Yesha Vora
> Assignee: Eric Yang
> Priority: Critical
>
> Launch of yarn service app is failing in secure mode with below stacktrace.
> {code:java}
> [hrt_qa@xxx root]$ kinit -kt /home/hrt_qa/hadoopqa/keytabs/hrt_qa.headless.keytab hrt_qa
> [hrt_qa@xxx root]$ yarn app -launch test2 sleeper
> WARNING: YARN_LOG_DIR has been replaced by HADOOP_LOG_DIR. Using value of YARN_LOG_DIR.
> WARNING: YARN_LOGFILE has been replaced by HADOOP_LOGFILE. Using value of YARN_LOGFILE.
> WARNING: YARN_PID_DIR has been replaced by HADOOP_PID_DIR. Using value of YARN_PID_DIR.
> WARNING: YARN_OPTS has been replaced by HADOOP_OPTS. Using value of YARN_OPTS.
> 18/02/07 22:50:40 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
> 18/02/07 22:50:41 INFO client.AHSProxy: Connecting to Application History server at xxx/xxx:10200
> 18/02/07 22:50:41 INFO client.AHSProxy: Connecting to Application History server at xxx/xxx:10200
> 18/02/07 22:50:41 INFO client.ApiServiceClient: Loading service definition from local FS: /usr/hdp/3.0.0.0-800/hadoop-yarn/yarn-service-examples/sleeper/sleeper.json
> 18/02/07 22:50:42 ERROR client.ApiServiceClient: Authentication required{code}
> CLI client does not send Kerberos header to Resource Manager rest API. Tcpdump indicate that there is no token being sent.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org