[FLINK-11126] Filter out AMRMToken in the TaskManager credentials

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.6.2, 1.6.4, 1.7.0, 1.7.2, 1.8.0
• Fix Version/s: 1.7.3, 1.8.1, 1.9.0
• Component/s: Deployment / YARN
• Labels: pull-request-available
• Assignee: Paul Lin
• Reporter: Paul Lin
• Created: 11/Dec/18 05:17
• Updated: 27/May/19 10:36
• Resolved: 27/May/19 10:36

Description

Currently, Flink JobManager propagates its storage tokens to TaskManager to meet the requirement of YARN log aggregation (see FLINK-6376). But in this way the AMRMToken is also included in the TaskManager credentials, which could be potentially insecure. We should filter out AMRMToken before setting the tokens to TaskManager's container launch context.

Issue Links

• relates to: FLINK-6376 when deploy flink cluster on the yarn, it is lack of hdfs delegation token.
• links to: GitHub Pull Request #7294
• links to: GitHub Pull Request #7895