Kerberos support

[Sean Zhong]

I am not sure about this,

Does Storm-yarn support Kerberos enabled YARN? Where is the related code?

[Bobby Evans]

We have tested it on secure YARN, but it will not be secure.

—Bobby

--
You received this message because you are subscribed to the Google Groups "storm-yarn" group.
To unsubscribe from this group and stop receiving emails from it, send an email to storm-yarn+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Sean Zhong]

Thanks, buy why "it will not be secure"?

[Bobby Evans]

Nimbus and the AM will come up but they will not authenticate the clients that connect to them.  Even if you took the security changes we have made to storm, the kerberos thrift SASL server requires that you have a service principal, which will not be  available on YARN.  To make it work you would have to write a new SASL plugin that would use Hadoop delegation tokens similar to how MapReduce works, both for the client and the server side.  I am also not totally sure how you would make it work with zookeeper, which does not have delegation tokens.  There would need to be some work around that.  Once you have that everything except the code we wrote for run as user should be OK.

—Bobby

[Sean Zhong]

Thank you for this information. Not quite understand the zookeeper part, but I will check that.