[MAPREDUCE-7236] HadoopArchiveLogs will use token to create proxy user when kerberos on

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.9.2
• Target Version/s: 3.5.0
• Assignee: Unassigned
• Reporter: Yicong Cai
• Created: 28/Aug/19 12:01
• Updated: 04/Jan/24 09:32

Description

HadoopArchiveLogsRunner runs in the Yarn Container via DistributedShell.
The Client of the DistributedShell gets the Token and uses it for the Runner.
The Runner create ProxyUser via Token, which violates the ProxyUser principle.

There are two solutions:
1. Pass the Keytab to the Runner, login with Keytab and create ProxyUser.
2. Run the HadoopArchiveLogs task with HDFS Super User. After the Archive is finished, use chown to modify it to the corresponding user.

I prefer to use the first way to solve the problem. Any suggestions?

Issue Links

• is related to: MAPREDUCE-6415 Create a tool to combine aggregated logs into HAR files