Bulk Operation

YARN-47 ClientToAMTokenMasterKey should be provided to AM at launch time

YARN-47 Queue admin ACLs should NOT be similar to submit-acls w.r.t hierarchy.

YARN-47 NM is polluting container's credentials

YARN-47 NodeManager should allow queue admins to view app-logs

YARN-47 Add tests to verify that queue-admin-acls work with hierarchical queues

YARN-47 Parse html response returned by Application master when showing it via WebProxy

YARN-47 Yarn and MRv2 should do HTTP client authentication in kerberos setup.

YARN-47 ContainerManagerImpl should enforce token on server. Today it is [TOKEN, SIMPLE]

YARN-47 Get queue administration ACLs working

YARN-47 Node manager is no longer required to store ContainerToken as it is required only during startContainer call.

YARN-47 Share NMTokens using NMTokenCache (api-based) instead of memory based approach which is used currently.

YARN-47 NM startContainer should validate the NodeId

YARN-47 ApplicationTokens should be used irrespective of kerberos

YARN-47 Start using NMTokens to authenticate all communication with NM

YARN-47 Sending NMToken to AM on allocate call

YARN-47 Creating NMToken master key on RM and sharing it with NM as a part of RM-NM heartbeat.

YARN-47 AMTokens, ClientTokens and LocalizerTokens should be generated and used irrespective of kerberos

YARN-47 RM triggers web auth failure before first job

YARN-47 In unsercure mode, AM can fake resource requirements

YARN-47 Create NM proxy per NM instead of per container

YARN-47 ClientToken (ClientToAMToken) should not be set in the environment

YARN-47 Make ApplicationToken part of Container's token list to help RM-restart

YARN-47 NodeManager should use SecureIOUtils for serving and aggregating logs

YARN-47 ContainerManager APIs should be user accessible

YARN-47 DelegationTokens will be renewed forever if multiple jobs share tokens and the first one sets JOB_CANCEL_DELEGATION_TOKEN to false

YARN-47 RM doesn't retry token renewals

YARN-47 RM renews tokens even when maxDate will soon be exceeded

YARN-47 RM does not reject app submission with invalid tokens

YARN-47 ClientTokens should be per app-attempt and be unregistered on App-finish.

YARN-47 ClientToAMSecretManager creates keys without checking for validity of the appID

YARN-47 AM should not be able to abuse container tokens for repetitive container launches

YARN-47 NMs rejects all container tokens after secret key rolls

YARN-47 [MR-279] [Security] AM should not be able to abuse container tokens for repetitive container launches

YARN-47 Implement renewal / cancellation of Delegation Tokens

YARN-47 Improve distributed shell application to work on a secure cluster

YARN-47 Tests for verifying application-acl checks on the web-UI

YARN-47 RM-NM secret-keys should be randomly generated and rolled every so often

YARN-47 Move to per-node RM-NM secrets