[HDFS-15383] RBF: Disable watch in ZKDelegationSecretManager for performance

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.3.6
• Fix Version/s: 3.4.0, 3.3.6
• Component/s: rbf
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.6
• Hadoop Flags: Reviewed
• Assignee: Fengnan Li
• Reporter: Fengnan Li
• Created: 02/Jun/20 20:27
• Updated: 11/Feb/24 06:29
• Resolved: 23/Jun/20 20:12

Description

Based on the current design for delegation token in secure Router, the total number of watches for tokens is the product of number of routers and number of tokens, this is due to ZKDelegationTokenManager is using PathChildrenCache from curator, which automatically sets the watch and ZK will push the sync information to each router. There are some evaluations about the number of watches in Zookeeper has negative performance impact to Zookeeper server.

In our practice when the number of watches exceeds 1.2 Million in a single ZK server there will be significant ZK performance degradation. Thus this ticket is to rewrite ZKDelegationTokenManagerImpl.java to explicitly disable the PathChildrenCache and have Routers sync periodically from Zookeeper. This has been working fine at the scale of 10 Routers with 2 million tokens. 

Issue Links

• is related to: HADOOP-16876 KMS delegation tokens are memory expensive
• is related to: HADOOP-16828 Zookeeper Delegation Token Manager fetch sequence number by batch
• links to: GitHub Pull Request #5112
• links to: https://github.com/apache/hadoop/pull/2047