question Re: DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default" in Support Questions

DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default"

PrernaU — Tue, 01 Jun 2021 14:24:45 GMT

On a kerberized HDP cluster when I try to run dfsio it fails with below error

##########################################

org.apache.hadoop.yarn.proto.ApplicationClientProtocol$ApplicationClientProtocolService$2.callBlockingMethod(ApplicationClientProtocol.java:563)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:524)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:1025)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:876)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:822)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730)
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2682)
Caused by: org.apache.hadoop.security.AccessControlException: User hdfs does not have permission to submit application_1622150236559_0013 to queue default
at org.apache.hadoop.yarn.server.resourcemanager.RMAppManager.createAndPopulateNewRMApp(RMAppManager.java:429)
... 12 more

at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1498)
at org.apache.hadoop.ipc.Client.call(Client.java:1444)
at org.apache.hadoop.ipc.Client.call(Client.java:1354)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:228)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:116)
at com.sun.proxy.$Proxy12.submitApplication(Unknown Source)
at org.apache.hadoop.yarn.api.impl.pb.client.ApplicationClientProtocolPBClientImpl.submitApplication(ApplicationClientProtocolPBClientImpl.java:289)

Re: DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default"

PrernaU — Tue, 01 Jun 2021 10:02:17 GMT

This is on a Kerberized HDP Cluster

Re: DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default"

Sean464 — Mon, 07 Jun 2021 05:35:29 GMT

@PrernaU

The below exception hints that 'hdfs' user is not authorised to submit jobs in the Yarn queue 'default', and this is due to ACL in place.

Caused by: org.apache.hadoop.security.AccessControlException: User hdfs does not have permission to submit application_1622150236559_0013 to queue default

Is ACL managed by Ranger please? If so, we will need to add 'hdfs' user to have complete access over Yarn queue 'default' under Yarn policies in Ranger UI.

Re: DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default"

VidyaSargur — Mon, 14 Jun 2021 05:49:13 GMT

Hi @PrernaU, did @Sean464's solution help you? If so, can you please mark the appropriate reply as the solution? It will make it easier for others to find the answer in the future.