[
https://issues.apache.org/jira/browse/FLINK-22534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17343786#comment-17343786
]
Junfan Zhang commented on FLINK-22534:
--------------------------------------
Wow, thanks for your review. [~lirui].
> Set delegation token's service name as credential alias
> -------------------------------------------------------
>
> Key: FLINK-22534
> URL: https://issues.apache.org/jira/browse/FLINK-22534
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Hadoop Compatibility
> Reporter: Junfan Zhang
> Assignee: Junfan Zhang
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.14.0
>
> Attachments: debug2.PNG
>
>
> h4. What
> Set the Hadoop delegation token's service name as credential alias.
> h4. Why
> In current implementation, Flink will use delegation token's service name or
> identifer as credential alias, refer to Flink code
> [HadoopModule|https://github.com/apache/flink/blob/c6997c97c575d334679915c328792b8a3067cfb5/flink-runtime/src/main/java/org/apache/flink/runtime/security/modules/HadoopModule.java#L101]
> and [Yarn
> Utils|https://github.com/apache/flink/blob/c6997c97c575d334679915c328792b8a3067cfb5/flink-yarn/src/main/java/org/apache/flink/yarn/Utils.java#L209].
> Firstly, I think we could use the same way to set credential alias, like
> delegation token's service name. It will be more clear.
> Secondly, when fetching HDFS delegation token and then inject all tokens to
> current UserGroupInformation in Hadoop HDFS HA mode, it will cause the
> problem of overwriting the different delegation tokens with the same
> identifier, [refer to code
> here|https://github.com/apache/flink/blob/c6997c97c575d334679915c328792b8a3067cfb5/flink-yarn/src/main/java/org/apache/flink/yarn/Utils.java#L209].
> h5. When does the same identifier delegation tokens appear?
> When in HDFS HA mode, Hadoop HA delegation tokens will have the same
> identifier(Refer to HDFS-9276), but its' service name is different. So we can
> use service name as alias.
> The following figure from HDFS-9276 can show that the identifier of HA
> delegation token is the same.
> !debug2.PNG!
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
