pan3793 commented on PR #8377: URL: https://github.com/apache/hadoop/pull/8377#issuecomment-4196248709
The `systemCredentials` was introduced in YARN-2704, for a dedicated purpose - providing up-to-date HDFS DT for localization and log-aggregation, this PR is trying to extend the scope, to expose the `systemCredentials` to `LaunchContainer`, I'm not sure whether this is really a right direction - 1. Localization and log-aggregation are RM stuff, kind of system operation, so it's fine to use `systemCredentials`. with this change, `systemCredentials` is exposed to the container process (accessible by user code). there is no privilege escalation, though. 2. Scope is limited. `systemCredentials` contains only up-to-date HDFS token, does not cover other services DT > newly launched or re-initialized containers may receive stale delegation tokens ... For a long-running app, is it AM's responsibility to refresh the token for the newly launched containers? For re-initialized containers, yes, it's problematic, this patch can partially solve the issue, but it does not look like an elegant solution. For change itself, PR says "mirrors localizer" but actually uses merge vs. localizer's full replace. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
