Skip to main content
PrernaU
Silver ⭐️⭐️⭐️
June 1, 2021
Solved

DFSIO fails with error "User hdfs does not have permission to submit application_1622150236559_0013 to queue default"

On a kerberized HDP cluster when I try to run dfsio it fails with below error

##########################################

org.apache.hadoop.yarn.proto.ApplicationClientProtocol$ApplicationClientProtocolService$2.callBlockingMethod(ApplicationClientProtocol.java:563)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:524)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:1025)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:876)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:822)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1730)
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2682)
Caused by: org.apache.hadoop.security.AccessControlException: User hdfs does not have permission to submit application_1622150236559_0013 to queue default
at org.apache.hadoop.yarn.server.resourcemanager.RMAppManager.createAndPopulateNewRMApp(RMAppManager.java:429)
... 12 more

at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1498)
at org.apache.hadoop.ipc.Client.call(Client.java:1444)
at org.apache.hadoop.ipc.Client.call(Client.java:1354)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:228)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:116)
at com.sun.proxy.$Proxy12.submitApplication(Unknown Source)
at org.apache.hadoop.yarn.api.impl.pb.client.ApplicationClientProtocolPBClientImpl.submitApplication(ApplicationClientProtocolPBClientImpl.java:289)

 

Sean464
Sean464Answer
Gold ⭐️
June 7, 2021

@PrernaU 

 

The below exception hints that 'hdfs' user is not authorised to submit jobs in the Yarn queue 'default', and this is due to ACL in place. 

 

Caused by: org.apache.hadoop.security.AccessControlException: User hdfs does not have permission to submit application_1622150236559_0013 to queue default

Is ACL managed by Ranger please? If so, we will need to add 'hdfs' user to have complete access over Yarn queue 'default' under Yarn policies in Ranger UI. 

 

 

3 replies

PrernaU
PrernaUAuthor
Silver ⭐️⭐️⭐️
June 1, 2021

This is on a Kerberized HDP Cluster

Translate
Sean464
Gold ⭐️
Sean464Answer
Gold ⭐️
June 7, 2021

@PrernaU 

 

The below exception hints that 'hdfs' user is not authorised to submit jobs in the Yarn queue 'default', and this is due to ACL in place. 

 

Caused by: org.apache.hadoop.security.AccessControlException: User hdfs does not have permission to submit application_1622150236559_0013 to queue default

Is ACL managed by Ranger please? If so, we will need to add 'hdfs' user to have complete access over Yarn queue 'default' under Yarn policies in Ranger UI. 

 

 

Translate
VidyaSargur
Community Manager
Community Manager
June 14, 2021

Hi @PrernaU, did @Sean464's solution help you?  If so, can you please mark the appropriate reply as the solution? It will make it easier for others to find the answer in the future. 

Translate
Regards, Vidya Sargur, Community Manager Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button.