[YARN-3055] The token is not renewed properly if it's shared by jobs (oozie) in DelegationTokenRenewer

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 2.7.0, 2.6.1, 3.0.0-alpha1
• Component/s: security
• Labels: 2.6.1-candidate
• Target Version/s: 2.7.0
• Hadoop Flags: Reviewed
• Assignee: Daryn Sharp
• Reporter: Yi Liu
• Created: 13/Jan/15 08:22
• Updated: 30/Aug/16 01:28
• Resolved: 09/Apr/15 20:12

Description

After YARN-2964, there is only one timer to renew the token if it's shared by jobs.
In removeApplicationFromRenewal, when going to remove a token, and the token is shared by other jobs, we will not cancel the token.
Meanwhile, we should not cancel the timerTask, also we should not remove it from allTokens. Otherwise for the existing submitted applications which share this token will not get renew any more, and for new submitted applications which share this token, the token will be renew immediately.

For example, we have 3 applications: app1, app2, app3. And they share the token1. See following scenario:
1). app1 is submitted firstly, then app2, and then app3. In this case, there is only one token renewal timer for token1, and is scheduled when app1 is submitted
2). app1 is finished, then the renewal timer is cancelled. token1 will not be renewed any more, but app2 and app3 still use it, so there is problem.

Issue Links

• is duplicated by: YARN-3439 RM fails to renew token when Oozie launcher leaves before sub-job finishes
• relates to: YARN-2964 RM prematurely cancels tokens for jobs that submit jobs (oozie)
• relates to: YARN-4639 Remove dead code in TestDelegationTokenRenewer added in YARN-3055