[YARN-3053] [Security] Review and implement authentication in ATS v.2

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.9.0, YARN-5355
• Component/s: timelineserver
• Labels: YARN-5355 yarn-5355-merge-blocker
• Target Version/s: YARN-5355
• Hadoop Flags: Reviewed
• Assignee: Varun Saxena
• Reporter: Sangjin Lee
• Created: 13/Jan/15 01:04
• Updated: 21/Oct/17 06:05
• Resolved: 22/Aug/17 05:37

Description

Per design in YARN-2928, we want to evaluate and review the system for security, and ensure proper security in the system.

This includes proper authentication, token management, access control, and any other relevant security aspects.

Issue Links

• incorporates: MAPREDUCE-6838 [ATSv2 Security] Add timeline delegation token received in allocate response to UGI
• incorporates: YARN-5647 [ATSv2 Security] Collector side changes for loading auth filters and principals
• incorporates: YARN-5648 [ATSv2 Security] Client side changes for authentication
• incorporates: YARN-6130 [ATSv2 Security] Generate a delegation token for AM when app collector is created and pass it to AM via NM and RM
• incorporates: YARN-6133 [ATSv2 Security] Renew delegation token for app automatically if an app collector is active
• incorporates: YARN-6134 [ATSv2 Security] Regenerate delegation token for app just before token expires if app collector is active
• incorporates: YARN-7006 [ATSv2 Security] Changes for authentication for CollectorNodemanagerProtocol
• is a child of: YARN-6638 [ATSv2 Security] Timeline reader side changes for loading auth filters and principals
• is duplicated by: YARN-3402 Security support for new timeline service.
• is related to: YARN-3401 [Security] users should not be able to create a generic TimelineEntity and associate arbitrary type
• Parent Feature: YARN-6699 [ATSv2 Security] Delegation token support for Timeline reader