[HADOOP-16298] Manage/Renew delegation tokens for externally scheduled jobs

• Type: Improvement
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.0
• Component/s: security
• Labels: pull-request-available
• Target Version/s: 3.5.0
• Assignee: Clay B.
• Reporter: Pankaj Deshpande
• Created: 06/May/19 22:50
• Updated: 04/Jan/24 11:22

Description

• Presently when jobs are run in the Hadoop ecosystem, the implicit assumption is that YARN will be used as a scheduling agent with access to appropriate keytabs for renewal of kerberos tickets and delegation tokens.
• Jobs that interact with kerberized hadoop services such as hbase/hive/hdfs and use an external scheduler such as Kubernetes, typically do not have access to keytabs. In such cases, delegation tokens are a logical choice for interacting with a kerberized cluster. These tokens are issued based on some external auth mechanism (such as Kube LDAP authentication).

Issue Links

• links to: GitHub Pull Request #4059