[OOZIE-2797] Add a framework for cancellation of Delegation Tokens in Oozie AM

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Satish Saley
• Reporter: Satish Saley
• Created: 13/Feb/17 23:37
• Updated: 09/Dec/19 08:34

Description

Pig and hive clients when run from command line take care of canceling HCatalog delegation tokens. But they do not get cancelled when run via Oozie. RM only supports cancellation of hdfs and yarn tokens on job completion. So when running with Oozie, it is left to the HCatalog server to remove the token after the expiry. When there are too many jobs, the number of unexpired tokens can overwhelm the hcat server and cause outages. Oozie should take care of canceling these tokens after the job is done to avoid that.

We should add a token cancellation framework in the new Oozie AM to support implementations for token cancellation for different credential types similar to CredentialsProvider.

Attaching a reference patch that we used internally for directly canceling hcat tokens for just pig and hive actions that could be used by anyone who needs it till OOZIE-1770 is done and the new token cancellation framework is added by this jira.

Issue Links

• depends upon: OOZIE-1770 Create Oozie Application Master for YARN
• relates to: HIVE-17609 Tool to manipulate delegation tokens