Package org.apache.hadoop.yarn.server.resourcemanager.security

Class DelegationTokenRenewer

java.lang.Object

org.apache.hadoop.service.AbstractService

org.apache.hadoop.yarn.server.resourcemanager.security.DelegationTokenRenewer

All Implemented Interfaces:

Closeable, AutoCloseable, org.apache.hadoop.service.Service

@Private
@Unstable
public class DelegationTokenRenewer
extends org.apache.hadoop.service.AbstractService

Service to renew application delegation tokens.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected class	DelegationTokenRenewer.DelegationTokenToRenew	class that is used for keeping tracks of DT to renew

Nested classes/interfaces inherited from interface org.apache.hadoop.service.Service

org.apache.hadoop.service.Service.STATE

Field Summary

Fields

Modifier and Type	Field	Description
static final long	DEFAULT_RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING
static final org.apache.hadoop.io.Text	HDFS_DELEGATION_KIND
static final String	RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING
static final String	SCHEME

Constructor Summary

Constructors

Constructor	Description
DelegationTokenRenewer()

Method Summary

Modifier and Type	Method	Description
void	addApplicationAsync(org.apache.hadoop.yarn.api.records.ApplicationId applicationId, org.apache.hadoop.security.Credentials ts, boolean shouldCancelAtEnd, String user, org.apache.hadoop.conf.Configuration tokenConf)	Asynchronously add application tokens for renewal.
void	addApplicationAsyncDuringRecovery(org.apache.hadoop.yarn.api.records.ApplicationId applicationId, org.apache.hadoop.security.Credentials ts, boolean shouldCancelAtEnd, String user, org.apache.hadoop.conf.Configuration tokenConf)	Asynchronously add application tokens for renewal.
void	addApplicationSync(org.apache.hadoop.yarn.api.records.ApplicationId applicationId, org.apache.hadoop.security.Credentials ts, boolean shouldCancelAtEnd, String user)
void	applicationFinished(org.apache.hadoop.yarn.api.records.ApplicationId applicationId)	Removing delegation token for completed applications.
protected ThreadPoolExecutor	createNewThreadPoolService(org.apache.hadoop.conf.Configuration conf)
protected ConcurrentMap<org.apache.hadoop.security.token.Token<?>,DelegationTokenRenewer.DelegationTokenToRenew>	getAllTokens()
Set<org.apache.hadoop.security.token.Token<?>>	getDelegationTokens()
protected org.apache.hadoop.security.token.Token<?>[]	obtainSystemTokensForUser(String user, org.apache.hadoop.security.Credentials credentials)
protected void	renewToken(DelegationTokenRenewer.DelegationTokenToRenew dttr)
protected void	serviceInit(org.apache.hadoop.conf.Configuration conf)
protected void	serviceStart()
protected void	serviceStop()
void	setDelegationTokenRenewerPoolTracker(boolean flag)
void	setRMContext(RMContext rmContext)
protected void	setTimerForTokenRenewal(DelegationTokenRenewer.DelegationTokenToRenew token)	set task to renew the token.
void	updateKeepAliveApplications(List<org.apache.hadoop.yarn.api.records.ApplicationId> appIds)	Add a list of applications to the keep alive list.

Methods inherited from class org.apache.hadoop.service.AbstractService

close, getBlockers, getConfig, getFailureCause, getFailureState, getLifecycleHistory, getName, getServiceState, getStartTime, init, isInState, noteFailure, putBlocker, registerGlobalListener, registerServiceListener, removeBlocker, setConfig, start, stop, toString, unregisterGlobalListener, unregisterServiceListener, waitForServiceToStop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

HDFS_DELEGATION_KIND

@VisibleForTesting
public static final org.apache.hadoop.io.Text HDFS_DELEGATION_KIND

SCHEME

public static final String SCHEME

See Also:

• Constant Field Values

RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING

public static final String RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING

See Also:

• Constant Field Values

DEFAULT_RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING

public static final long DEFAULT_RM_SYSTEM_CREDENTIALS_VALID_TIME_REMAINING

See Also:

• Constant Field Values

Constructor Details

DelegationTokenRenewer

public DelegationTokenRenewer()

Method Details

serviceInit

protected void serviceInit(org.apache.hadoop.conf.Configuration conf)
                    throws Exception

Overrides:

serviceInit in class org.apache.hadoop.service.AbstractService

Throws:

Exception

createNewThreadPoolService

protected ThreadPoolExecutor createNewThreadPoolService(org.apache.hadoop.conf.Configuration conf)

serviceStart

protected void serviceStart()
                     throws Exception

Overrides:

serviceStart in class org.apache.hadoop.service.AbstractService

Throws:

Exception

serviceStop

protected void serviceStop()

Overrides:

serviceStop in class org.apache.hadoop.service.AbstractService

getDelegationTokens

@VisibleForTesting
public Set<org.apache.hadoop.security.token.Token<?>> getDelegationTokens()

addApplicationAsync

public void addApplicationAsync(org.apache.hadoop.yarn.api.records.ApplicationId applicationId,
 org.apache.hadoop.security.Credentials ts,
 boolean shouldCancelAtEnd,
 String user,
 org.apache.hadoop.conf.Configuration tokenConf)

Asynchronously add application tokens for renewal.

Parameters:

applicationId - added application

ts - tokens

shouldCancelAtEnd - true if tokens should be canceled when the app is done else false.

user - user

tokenConf - tokenConf sent by the app-submitter

addApplicationAsyncDuringRecovery

public void addApplicationAsyncDuringRecovery(org.apache.hadoop.yarn.api.records.ApplicationId applicationId,
 org.apache.hadoop.security.Credentials ts,
 boolean shouldCancelAtEnd,
 String user,
 org.apache.hadoop.conf.Configuration tokenConf)

Asynchronously add application tokens for renewal.

Parameters:

applicationId - added application

ts - tokens

shouldCancelAtEnd - true if tokens should be canceled when the app is done else false.

user - user

tokenConf - tokenConf sent by the app-submitter

addApplicationSync

public void addApplicationSync(org.apache.hadoop.yarn.api.records.ApplicationId applicationId,
 org.apache.hadoop.security.Credentials ts,
 boolean shouldCancelAtEnd,
 String user)
                        throws IOException,
InterruptedException

Throws:

IOException

InterruptedException

setTimerForTokenRenewal

@VisibleForTesting
protected void setTimerForTokenRenewal(DelegationTokenRenewer.DelegationTokenToRenew token)
                                throws IOException

set task to renew the token.

Parameters:

token - DelegationTokenToRenew.

Throws:

IOException - if an IO error occurred.

renewToken

@VisibleForTesting
protected void renewToken(DelegationTokenRenewer.DelegationTokenToRenew dttr)
                   throws IOException

Throws:

IOException

obtainSystemTokensForUser

@VisibleForTesting
protected org.apache.hadoop.security.token.Token<?>[] obtainSystemTokensForUser(String user,
 org.apache.hadoop.security.Credentials credentials)
                                                                         throws IOException,
InterruptedException

Throws:

IOException

InterruptedException

applicationFinished

public void applicationFinished(org.apache.hadoop.yarn.api.records.ApplicationId applicationId)

Removing delegation token for completed applications.

Parameters:

applicationId - completed application

updateKeepAliveApplications

public void updateKeepAliveApplications(List<org.apache.hadoop.yarn.api.records.ApplicationId> appIds)

Add a list of applications to the keep alive list. If an appId already exists, update it's keep-alive time.

Parameters:

appIds - the list of applicationIds to be kept alive.

setRMContext

public void setRMContext(RMContext rmContext)

setDelegationTokenRenewerPoolTracker

@VisibleForTesting
public void setDelegationTokenRenewerPoolTracker(boolean flag)

getAllTokens

protected ConcurrentMap<org.apache.hadoop.security.token.Token<?>,DelegationTokenRenewer.DelegationTokenToRenew> getAllTokens()