[FLINK-15561] Unify Kerberos credentials checking

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.10.1, 1.11.0
• Component/s: Deployment / YARN
• Labels: pull-request-available usability
• Assignee: Rong Rong
• Reporter: Rong Rong
• Created: 12/Jan/20 17:12
• Updated: 02/Jun/20 10:10
• Resolved: 22/Feb/20 00:11

Description

Inspired by the discussion in http://apache-flink-user-mailing-list-archive.2336050.n4.nabble.com/Yarn-Kerberos-issue-td31894.html#a31933

 

Currently the security HadoopModule handles delegation token login utilizes 2 different code path. 

Flink needs to to ensure delegation token is also a valid format of credential when launching YARN context. See [1] https://github.com/apache/flink/blob/master/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java#L484 and [2] https://github.com/apache/flink/blob/master/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/HadoopModule.java#L146

Issue Links

• causes: FLINK-18045 Fix Kerberos credentials checking to unblock Flink on secured MapR
• links to: GitHub Pull Request #10891