> On 10 Mar 2016, at 16:42, Tim I <[email protected]> wrote: > > Jon, > > That's consistent with my experience: > > From a kerberos prespective, you can renew a ticket within the renewal > window (default 24 hours I think) > > You can only renew the ticket up to the KDC's setting for 'renew_lifetime' > (which I believe defaults to 7 days). After that point, you need a new > ticket via the original credential (keytab, etc..). >
Oh, it's even more complex than that I'm afraid —there's kerberos tickets and hadoop tokens tickets: self contained, authenticate a principal with another principal, can be passed on, can be renewed until they expire hadoop tokens: essentially encrypted indexes into datastructures held by the services; can be refreshed, can be deliberately destroyed (remove whats at the end). Can be passed on. Renewable via IPC or in some cases HTTP(S) —its for different services. . May come with a shorter lifespan than a kerberos ticket, or a longer one. There's no chatter with the KDC, which has a lot less load on it than otherwise, and there's no need for an HDFS client to auth with every single datanode it may want to talk to. when you launch an app into a YARN cluster (without a keytab), your kerberos ticket is never bundled. The client gets explicit tokens for the services (HBase, HDFS, ...), adds them to the YARN launch context, then fires it off. They are "magically" picked up at the far end (I'll skip the details, except the magic involves files and the HADOOP_TOKEN_FILE_LOCATION env var), and renewed by the UGI thread until they run out. When your tokens expire, that's it, unless you are logged in with kerberos via kinit, or can log in via keytab. Which is what it comes down, as tim pointed out. After a few days, no keytab == no fun. see also https://github.com/apache/hadoop/blob/trunk/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-site/src/site/markdown/YarnApplicationSecurity.md
