[jira] [Updated] (YARN-60) NMs rejects all container tokens after secret key rolls

["Daryn Sharp (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/YARN-60?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Daryn Sharp updated YARN-60:
----------------------------

    Description: The NM's token secret manager will reject all container tokens after the secret key is activated which means the NM will not launch _any_ containers including AMs.  The whole yarn cluster becomes inoperable in 1d.  (was: The NM's token secret manager will reject all container tokens after the third secret key is activated which means the NM will not launch _any_ containers including AMs.  The whole yarn cluster becomes inoperable in 2d 15m (default 1d key roll + 15m activation delay).

The NM tracks the previous 2 secrets, so either the RM is generating tokens with an old secret, or more likely the NMs are going out of sync when discarding the oldest secret.)
        Summary: NMs rejects all container tokens after secret key rolls  (was: NMs rejects all container tokens after 2nd secret key roll)
    
> NMs rejects all container tokens after secret key rolls
> -------------------------------------------------------
>
>                 Key: YARN-60
>                 URL: https://issues.apache.org/jira/browse/YARN-60
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: nodemanager
>    Affects Versions: 2.2.0-alpha, 0.23.3
>            Reporter: Daryn Sharp
>            Assignee: Vinod Kumar Vavilapalli
>            Priority: Blocker
>
> The NM's token secret manager will reject all container tokens after the secret key is activated which means the NM will not launch _any_ containers including AMs.  The whole yarn cluster becomes inoperable in 1d.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira