[YARN-7425] Failed to renew delegation token when RM user's TGT is expired

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Won't Fix
• Affects Version/s: 2.8.2
• Component/s: yarn
• Assignee: Shen Yinjie
• Reporter: Shen Yinjie
• Created: 01/Nov/17 09:35
• Updated: 08/Nov/17 09:37
• Resolved: 08/Nov/17 09:37

Description

we have a secure hadoop cluster with namenode federation.
submit job fails after kerberos TGT maxLifeTime expired(default 24h), client log shows" failed to renew token: HDFS_DELEGATION_TOKEN...".
check rm log, found rm tgt is expired but not triggers relogin(),just retry and fail...
(rm log see screenshot)
digging in code:
when rm tries to renewToken(),
UserGroupInformation.getLoginUser()="rm",
but UserGroupInformation.getCurrentUser()="testUser".
this causes Client.shouldAuthenticateOverKrb() returns false, thus cant trigger reloginFromKeytab() or reloginFromTicketCache().