[HADOOP-16828] Zookeeper Delegation Token Manager fetch sequence number by batch

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.1, 3.4.0
• Fix Version/s: 3.3.1, 3.4.0
• Component/s: security
• Target Version/s: 3.3.1, 3.4.0
• Hadoop Flags: Reviewed
• Assignee: Fengnan Li
• Reporter: Fengnan Li
• Created: 25/Jan/20 22:26
• Updated: 11/Feb/24 06:25
• Resolved: 02/Jun/20 19:11

Description

Currently in ZKDelegationTokenSecretManager.java the seq number is incremented by 1 each time there is a request for creating new token. This will need to send traffic to Zookeeper server. With multiple managers running, there is data contention going on. Also, since the current logic of incrementing is using tryAndSet which is optimistic concurrency control without locking. This data contention is having performance degradation when the secret manager are under volume of traffic.

The change here is to fetching this seq number by batch instead of 1, which will reduce the traffic sent to ZK and make many operations inside ZK secret manager's memory.

After putting this into production we saw huge improvement to the RPC processing latency of get delegationtoken calls. Also, since ZK takes less traffic in this way. Other write calls, like renew and cancel delegation tokens are benefiting from this change.

 

 

Issue Links

• is related to: HADOOP-16876 KMS delegation tokens are memory expensive
• relates to: HDFS-15383 RBF: Disable watch in ZKDelegationSecretManager for performance