YARN with ACL - unable to view logs from RM webconsole

parnigot — Fri, 16 Sep 2022 10:31:45 GMT

Hello,

We are currently experimenting with ACLs on YARN pools.

Our goal is to have:

a pool for each application where only the authorized user can submit jobs
a group of users for each pool that can view application history and logs

I'm using the following fair-scheduler.xml file (generated with Cloudera Manager):

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<allocations>
    <queue name="root">
        <weight>1.0</weight>
        <schedulingPolicy>drf</schedulingPolicy>
        <aclSubmitApps></aclSubmitApps>
        <aclAdministerApps></aclAdministerApps>
        <queue name="appA">
            <weight>1.0</weight>
            <schedulingPolicy>drf</schedulingPolicy>
            <aclSubmitApps>appA developersA</aclSubmitApps>
            <aclAdministerApps>appA developersA</aclAdministerApps>
        </queue>
        <queue name="appB">
            <weight>1.0</weight>
            <schedulingPolicy>drf</schedulingPolicy>
            <aclSubmitApps>appB developersB</aclSubmitApps>
            <aclAdministerApps>appB developersB</aclAdministerApps>
        </queue>
    </queue>
</allocations>

For the point 1. (pool access only by app user) everything works fine, but I can't get to find a working configuration for point 2: for example if user devA (in group developersA) tries to view the logs for an application launched in appA get always the following error (in JH web console):

User [devA] is not authorized to view the logs for container_1469609032080_0001_01_000001 in log file

Any suggestion? Is this the intended behaviour or am I missing something?

Our cluster specs/settings:

yarn.acl.enable = true
yarn.admin.acl = "yarn clusterAdminGroup"
CDH 5.7
Kerberos authentication
YARN web interface also using Kerberos authentication

Thank you,
Bye

Re: YARN with ACL - unable to view logs from RM webconsole

haibochen — Wed, 27 Jul 2016 16:44:43 GMT

If you are referring to MapReduce Job History Server by JH, JHS has its own job ACL control. If a MR job is configured with

mapreduce.job.acl-view-job = {users you want to allow to view the job, see mapred-default.xml for details on format}

Then JHS will allow the specified user to view the job.

question Re: YARN with ACL - unable to view logs from RM webconsole in Archives of Support Questions (Read Only)

YARN with ACL - unable to view logs from RM webconsole

Re: YARN with ACL - unable to view logs from RM webconsole