question Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ? in Support Questions

Is there any way to disable "kill application" button to Resource Manager's Web UI ?

SK1 — Tue, 02 Feb 2016 15:37:13 GMT

Hello Friends,

Is there any way to disable "kill application" button to Resource Manager's Web UI ?

Thanks in advance.

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

amcbarnett — Tue, 02 Feb 2016 16:06:16 GMT

@Saurabh Kumar

Good question. I don't think there is a way to disable the "kill application" button.

Perhaps if a user is granted read only permission to the Dashboard in Ambari -> Manage Ambari, he might be unable to do so, but I also see that even a read only user can access the RM UI. So the only way is to not give that user any permission to the dashboard or to the RM UI via Knox secured by Ranger.

Perhaps someone else has a better answer.

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

bleonhardi — Tue, 02 Feb 2016 17:52:25 GMT

I think there are different options.

You can enable HTTP authentication using SPNEGO and kerberos for the web uis

https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/HttpAuthentication.html

( Problem is that Spnego is a bit finicky since the computers running the web browser need to be in the kerberos realm )

And you can disable administration of queues for specific users and groups. I.e. only allow a specific subgroup of users to kill applications.

https://hadoop.apache.org/docs/r2.4.1/hadoop-yarn/hadoop-yarn-site/CapacityScheduler.html#Configuration

Is your cluster kerberized?

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

jstraub — Tue, 02 Feb 2016 19:16:06 GMT

Regarding spnego authentication, also see this http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.1/bk_Ambari_Security_Guide/content/ch_enable_spnego_auth_for_hadoop.html

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

SK1 — Wed, 03 Feb 2016 13:56:53 GMT

Hi Benjamin,

Thanks for your reply. And no we do not have kerbaros in our cluster. We are just using knox and ranger.

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

bleonhardi — Wed, 03 Feb 2016 18:11:14 GMT

In that case you cannot use SPNEGO. But you might be able to stop users from administering queues. (killing applications ). I have seen these settings not working on a non-kerberized cluster but it might have been a bug.

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

SK1 — Sun, 21 Feb 2016 19:30:32 GMT

@Ancil McBarnett @Benjamin Leonhardi @Jonas Straub: I have successfully disabled "kill Application" button by adding below property to yarn-site.xml.

yarn.resourcemanager.webapp.ui-actions.enabled= false.

For more detailed steps you can refer to below link .

http://www.hadoopadmin.co.in/bigdata/how-to-disable-kill-application-button-in-resource-manager-web-ui/

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

SK1 — Sun, 21 Feb 2016 19:30:32 GMT

@Ancil McBarnett @Benjamin Leonhardi @Jonas Straub: I have successfully disabled "kill Application" button by adding below property to yarn-site.xml.

yarn.resourcemanager.webapp.ui-actions.enabled= false.

For more detailed steps you can refer to below link .

http://www.hadoopadmin.co.in/bigdata/how-to-disable-kill-application-button-in-resource-manager-web-ui/

Re: Is there any way to disable "kill application" button to Resource Manager's Web UI ?

bleonhardi — Sun, 21 Feb 2016 19:31:39 GMT

That is cool, I didn't find it in the original JIRA patch weird.