[AMBARI-25263] rm_security_opts should not be configured in YARN_OPTS/HADOOP_OPTS

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.7.0
• Component/s: ambari-server
• Labels: jaas kerberos
• Assignee: Unassigned
• Reporter: Tarun Parimi
• Created: 22/Apr/19 08:35
• Updated: 22/Apr/19 08:35

Description

After AMBARI-22824, rm_security_opts is defined in YARN_OPTS. YARN_OPTS is used by every single yarn command and daemon.

But this is not correct as rm_security_opts refers to the yarn_jaas.conf which contains the ResourceManager keytab and principal.

This leads to issues in certain kerberos environments where yarn client commands will not work for users not having access to the Resoucemanager keytab.

We should instead set rm_security_opts to YARN_RESOURCEMANAGER_OPTS.