[FLINK-6376] [yarn] Always upload HDFS delegation token for secured YARN deployments
Previously, YARN log aggregation fails because it depoends on the HDFS delegation token, which we do not upload if Kerberos keytabs are used. We did not include HDFS delegation tokens when keytabs are used because the UGI would prioritize the delegation token (which expires) if both are present. To address this, changes include: 1. Change Flink YARN client to always upload delegation tokens when security is enabled. This would then allow log aggregation. 2. Filter out HDFS delegation token from the tokens fetched from HDFS when populating the UGI. This allows the UGI to always use Kerberos tickets instead of the HDFS delegation token.
Showing
想要评论请 注册 或 登录