[YARN-3103] AMRMClientImpl does not update AMRM token properly

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.7.0, 2.6.1, 3.0.0-alpha1
• Component/s: client
• Labels: 2.6.1-candidate
• Target Version/s: 2.7.0
• Hadoop Flags: Reviewed
• Assignee: Jason Darrell Lowe
• Reporter: Jason Darrell Lowe
• Created: 27/Jan/15 16:58
• Updated: 16/Jul/19 10:47
• Resolved: 28/Jan/15 23:24

Description

AMRMClientImpl.updateAMRMToken updates the token service before storing it to the credentials, so the token is mapped using the newly updated service rather than the empty service that was used when the RM created the original AMRM token. This leads to two AMRM tokens in the credentials and can still fail if the AMRMTokenSelector picks the wrong one.

In addition the AMRMClientImpl grabs the login user rather than the current user when security is enabled, so it's likely the UGI being updated is not the UGI that will be used when reconnecting to the RM.

The end result is that AMs can fail with invalid token errors when trying to reconnect to an RM after a new AMRM secret has been activated.

Issue Links

• causes: FLINK-12623 Flink on yarn encountered AMRMClientImpl does not update AMRM token properly
• relates to: MAPREDUCE-6230 MR AM does not survive RM restart if RM activated a new AMRM secret key