JHSUYU opened a new pull request, #8377:
URL: https://github.com/apache/hadoop/pull/8377
Jira: [YARN-11954](https://issues.apache.org/jira/browse/YARN-11954)
#### Description
When the RM's `DelegationTokenRenewer` replaces a delegation token that
has reached its max lifetime, the new token is pushed to NodeManagers through
the heartbeat response as `systemCredentials`.
On the NM side, `ResourceLocalizationService.writeCredentials()` correctly
checks `NMContext.getSystemCredentialsForApps()` and uses the updated token
when writing the localizer's credential file.
However, `ContainerLaunch` does not — it writes the container's token file
using only `container.getCredentials()`, which still holds the original (now
invalid) token.
This means that for long-running applications (running beyond
`delegation.token.max-lifetime`, default 7 days), newly launched or
re-initialized containers may receive stale delegation tokens and fail with
authentication errors when accessing external services such as HDFS.
#### Fix
Add `getEffectiveCredentials()` in `ContainerLaunch` that merges system
credentials into the container credentials before writing the token file,
mirroring the localizer's behavior.
### How was this patch tested?
- Added `testContainerLaunchUsesSystemCredentials` in `TestContainerLaunch`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
