You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "Benjamin Teke (Jira)" <ji...@apache.org> on 2026/03/10 10:15:00 UTC
[jira] [Resolved] (YARN-11937) Yarn Proxy Behind a Reverse Proxy
[ https://issues.apache.org/jira/browse/YARN-11937?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Benjamin Teke resolved YARN-11937.
----------------------------------
Fix Version/s: 3.5.1
Hadoop Flags: Reviewed
Resolution: Fixed
> Yarn Proxy Behind a Reverse Proxy
> ---------------------------------
>
> Key: YARN-11937
> URL: https://issues.apache.org/jira/browse/YARN-11937
> Project: Hadoop YARN
> Issue Type: Improvement
> Components: yarn
> Affects Versions: 3.5.1
> Reporter: Bence Kosztolnik
> Assignee: Bence Kosztolnik
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.5.1
>
>
> h5. Description
> When the Yarn Proxy is deployed behind a reverse proxy that is also used in application tracking URLs, the Yarn Proxy should redirect requests to that proxy instead of attempting to proxy them internally.
> h5. Use Case
> Consider the following scenario:
> • A user runs a Spark job.
> • The Spark UI is hosted in the Spark History Server (SHS).
> • Multiple SHS instances are deployed for high availability (HA).
> • The tracking URL points to a Knox Gateway, which routes requests to the available SHS instances.
> This setup ensures high availability for the tracking UI. If one SHS instance becomes unavailable, another can continue serving the UI.
> h5. Problem Statement
> When the Knox Gateway forwards a user’s HTTP request to the Yarn Proxy, the Yarn Proxy attempts to proxy the request back to the Knox Gateway. However, this proxied request does not include the JWT token. As a result, Knox initiates authentication instead of forwarding the request to the appropriate SHS instance.
> h5. Proposed Solution
> For security reasons, the JWT token must not be forwarded to the tracking URL. Therefore, when an application registers a tracking URL that includes a specific flag indicating that it is served behind a reverse proxy, the Yarn Proxy should redirect the user directly to the tracking URL instead of attempting to proxy the request internally.
> h5. Config
> New config was created: +yarn.web-proxy.redirect-flag+
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org