[AMBARI-3966] Secure cluster: set group owner for the task-controller / container-executor binary based on appropriate settings in mapred-site.xml / yarn-site.xml

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.2
• Fix Version/s: 1.4.2
• Component/s: ambari-agent
• Assignee: Jaimin Jetly
• Reporter: Jaimin Jetly
• Created: 04/Dec/13 01:32
• Updated: 06/Dec/13 02:50
• Resolved: 05/Dec/13 22:31

Description

In order to set the group for the task-controller binary in Hadoop 1 or container-executor binary in Hadoop 2:

For Hadoop 1.x stack secure cluster:

• Stop MapReduce service.
• Reconfigure mapreduce.tasktracker.group property in MapReduce > Configs > Advanced section.
• Manually create the group per the value entered in mapreduce.tasktracker.group on each tasktracker host.
• Add mapred user to that group.
• Start the MapReduce service.
• This reconfigures the mapreduce.tasktracker.group property in /etc/hadoop/taskcontroller.cfg and also sets the group ownership for the /usr/lib/hadoop/bin/task-controller binary.
• Run MapReduce smoke test. Smoke test should pass.

For Hadoop 2.x stack secure cluster:

• Stop Yarn service.
• Reconfigure yarn.nodemanager.linux-container-executor.group property in YARN > Configs > Advanced section.
• Manually create the group per the value entered in yarn.nodemanager.linux-container-executor.group on each nodemanager host.
• Add yarn user to that group.
• Start the YARN service.
• This reconfigures the yarn.nodemanager.linux-container-executor.group property in /etc/hadoop/container-executor.cfg and also set the group value for the /usr/lib/hadoop-yarn/bin/container-executor binary.
• Run YARN smoke test. Smoke test should pass.