You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "Prabhu Joseph (JIRA)" <ji...@apache.org> on 2019/08/14 06:22:00 UTC
[jira] [Commented] (YARN-9735) Allow User Keytab to submit YARN
Native Service
[ https://issues.apache.org/jira/browse/YARN-9735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16906926#comment-16906926 ]
Prabhu Joseph commented on YARN-9735:
-------------------------------------
Hi [~eyang], Have missed to check the reason for Yarn Native Service supporting only service principal with hostname (YARN-8571). Have seen application users starts to test the YARN Native Service with their user keytab and face the above issue. Then they debug and find it requires a service keytab and which has to be created for every host on Dev, Test, Prod clusters and populated. I think this affects the usability for new users.
Have tested with user keytab and it is also working fine. Do you think if it is fine to allow user keytab. If not, will close this jira as invalid.
> Allow User Keytab to submit YARN Native Service
> ------------------------------------------------
>
> Key: YARN-9735
> URL: https://issues.apache.org/jira/browse/YARN-9735
> Project: Hadoop YARN
> Issue Type: Improvement
> Components: yarn-native-services
> Affects Versions: 3.2.0
> Reporter: Prabhu Joseph
> Assignee: Prabhu Joseph
> Priority: Major
>
> Yarn Native Service launch fails on a secure cluster with user keytab. It allows only service keytab. Have seen most of the users test their jobs with user keytab.
> {code}
> [ambari-qa@pjosephdocker-3 ~]$ yarn app -launch sleeper-service /usr/hdp/3.0.1.0-187/hadoop-yarn/yarn-service-examples/sleeper/sleeper.json
> 19/08/03 17:17:04 ERROR client.ApiServiceClient: Kerberos principal (ambari-qa-pjosephdocker@DOCKER.COM) does not contain a hostname.
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org