[YARN-4653] Document YARN security model from the perspective of Application Developers

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.2
• Fix Version/s: 2.8.0, 2.7.3, 3.0.0-alpha1
• Component/s: site
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 28/Jan/16 12:01
• Updated: 06/Jan/17 01:47
• Resolved: 14/Feb/16 09:26

Description

What YARN apps need to do for security today is generally copied direct from distributed shell, with a bit of ill-informed superstition being the sole prose.

We need a normative document in the YARN site covering

1. the needs for YARN security
2. token creation for AM launch
3. how the RM gets involved
4. token propagation on container launch
5. token renewal strategies
6. How to get tokens for other apps like HBase and Hive.
7. how to work under OOzie

Perhaps the WritingYarnApplications.md doc is updated, otherwise why not just link to the relevant bit of the distributed shell client on github for a guarantee of staying up to date?

Issue Links

• is related to: HADOOP-12649 Improve Kerberos diagnostics and failure handling
• is related to: HADOOP-9621 Document/analyze current Hadoop security model
• relates to: HADOOP-12752 Improve diagnostics/use of envvar/sysprop credential propagation
• relates to: SAMZA-727 Support for Kerberos
• relates to: SLIDER-1077 Improve slider credental setup under Oozie