[MAPREDUCE-3940] ContainerTokens should have an expiry interval

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.23.0
• Fix Version/s: 0.23.3, 2.0.2-alpha
• Component/s: mrv2, security
• Hadoop Flags: Reviewed
• Release Note: ContainerTokens now have an expiry interval so that stale tokens cannot be used for launching containers.
• Assignee: Vinod Kumar Vavilapalli
• Reporter: Vinod Kumar Vavilapalli
• Created: 29/Feb/12 19:26
• Updated: 11/Oct/12 17:48
• Resolved: 10/Jul/12 21:37

Description

• RM should generate the expiry time for a container
• A ContainerToken should have its expire time encoded
• NMs should reject containers with expired tokens.
• Expiry interval for a ContainerToken is same as the expiry interval for a container.

Issue Links

• blocks: YARN-39 RM-NM secret-keys should be randomly generated and rolled every so often
• duplicates: MAPREDUCE-2742 [MR-279] [Security] All tokens in YARN + MR should have an expiry interval