[HADOOP-13381] KMS clients should use KMS Delegation Tokens from current UGI.

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: kms
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed
• Assignee: Xiao Chen
• Reporter: Xiao Chen
• Created: 15/Jul/16 22:29
• Updated: 21/Oct/16 22:09
• Resolved: 29/Jul/16 01:46

Description

When /tmp is setup as an EZ, one may experience YARN log aggregation failure after the very first KMS token is expired. The MR job itself runs fine though.

When this happens, YARN NodeManager's log will show AuthenticationException with token is expired / token can't be found in cache, depending on whether the expired token is removed by the background or not.

Issue Links

• is duplicated by: HADOOP-13749 KMSClientProvider combined with KeyProviderCache can result in wrong UGI being used