@Harun
Zengin
By default Livy will launch an application on yarn, and usually the default master is set to yarn-cluster. This means and authenticated user could push code that could potentially run on any cluster worker nodes that have a running node manager. This containers are lunched by yarn, and the container process is always owned by the caller user (on this case the user that made the request to livy) So this container process will be running as the caller user and only have access to the caller users authorized resources. There is no way a user could read a keytab from the /etc/security/keytab directory. Same happens with HDFS data, unless this user has permissions to the files, user wont be able to access those. And this is valid also without Livy, as a user could use hdfs/webhdfs client to read data directly. At the same time there are other ways to push application code which are not limited to Livy. Like using spark-submit/spark-shell. Which work in similar fashion except perhaps those tend to be used from edge nodes on which only few users have access to. Having all that said, if you like to restrict access to Livy and not only rely on authentication. Look for Knox, Livy and Ranger integration to achieve this. This way you could reduce the number of users that use Livy's rest api by authorizing only specific groups/users. HTH *** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.
... View more
