[YARN-9986] signalToContainer REST API does not work even if requested by the app owner

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.0
• Component/s: restapi
• Labels: Reviewed
• Assignee: kyungwan nam
• Reporter: kyungwan nam
• Created: 19/Nov/19 01:40
• Updated: 19/Nov/19 11:52
• Resolved: 19/Nov/19 11:40

Description

signalToContainer REST API introduced in YARN-8693 does not work even if requested by the app owner.
It works well only if requested by an admin user

$ kinit kwnam
Password for [e-mail]:
$ curl  -H 'Content-Type: application/json' --negotiate -u : -X POST https://rm002.test.org:8088/ws/v1/cluster/containers/container_e58_1573625560605_29927_01_000001/signal/GRACEFUL_SHUTDOWN
{"RemoteException":{"exception":"ForbiddenException","message":"java.lang.Exception: Only admins can carry out this operation.","javaClassName":"org.apache.hadoop.yarn.webapp.ForbiddenException"}}$
$ kinit admin
Password for [e-mail]:
$
$ curl  -H 'Content-Type: application/json' --negotiate -u : -X POST https://rm002.test.org:8088/ws/v1/cluster/containers/container_e58_1573625560605_29927_01_000001/signal/GRACEFUL_SHUTDOWN
$

in contrast, the app owner can do it using the command line as below.

$ kinit kwnam
Password for [e-mail]:
$ yarn container -signal container_e58_1573625560605_29927_01_000002  GRACEFUL_SHUTDOWN
Signalling container container_e58_1573625560605_29927_01_000002
2019-11-19 09:12:29,797 INFO impl.YarnClientImpl: Signalling container container_e58_1573625560605_29927_01_000002 with command GRACEFUL_SHUTDOWN
2019-11-19 09:12:29,920 INFO client.ConfiguredRMFailoverProxyProvider: Failing over to rm2
$