Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Can't kill YARN apps using ResourceManager UI after HDP 3.1.0.0-78 upgrade

Highlighted

Can't kill YARN apps using ResourceManager UI after HDP 3.1.0.0-78 upgrade

New Contributor

I recently upgraded HDP from 2.6.5 to 3.1.0, which runs YARN 3.1.0, and I can no longer kill applications from the YARN ResourceManager UI, using either the old (:8088/cluster/apps) or new (:8088/ui2/index.html#/yarn-apps/apps) version. I can still kill them using the shell in RHEL 7 with yarn app -kill {app-id}

These applications are submitted via Livy. Here is my workflow:

Open the ResourceManagerUI, open the Application, click Settings and choose Kill Application. Notice, the 'Logged in as:' is set to UNKNOWN_USER:

103453-step1.png

Confirm that I want to kill the Application:

103454-step2.png

I get the following error in the UI:

103455-step3.png

Opening the console in Chrome, I see a 401 (Unauthorized) error.

103456-step4.png

If I try this from the old UI I am able to expand the error message and it shows the following:

{"RemoteException":{"exception":"AuthorizationException","message":"Unable to obtain user name, user not authenticated","javaClassName":"org.apache.hadoop.security.authorize.AuthorizationException"}}

I've read lots of posts, verified and changed several settings to try to fix this with no luck. Here are some of the settings I checked or changed as a result of my research:

hadoop.http.filter.initializers=org.apache.hadoop.security.HttpCrossOriginFilterInitializer,org.apache.hadoop.http.lib.StaticUserWebFilter
hbase.security.authentication=simple
hbase.security.authorization=false
yarn.nodemanager.webapp.cross-origin.enabled=true
yarn.resourcemanager.webapp.cross-origin.enabled=true
yarn.resourcemanager.webapp.delegation-token-auth-filter.enabled=false
yarn.resourcemanager.webapp.ui-actions.enabled=true
yarn.timeline-service.http-authentication.simple.anonymous.allowed=true
yarn.timeline-service.http-authentication.type=simple
yarn.webapp.api-service.enable=true
yarn.webapp.ui2.enable=true
ranger.add-yarn-authorization=false

Some of these seem way off base to me, like the hbase stuff, since I don't think that has anything to do with what I'm seeing. However, some users, in other situations, had it work for them so I wanted to try it.

Digging through the documentation it seems like you need to be authenticated before you can call the API. However, that same language was in the documentation for 2.6.5, which is the version of YARN I was running before where this worked.

Hopefully someone can point me to documentation that more clearly outlines what I can do to resolve the issue.

Thanks in advance.

Don't have an account?
Coming from Hortonworks? Activate your account here