[Improvement] Support kill yarn application through proxy user
- Dominant language
- Scala
- Stars
- 2.4k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.
### What would you like to be improved?
Kyuubi always uses the current user to do `yarnClient.killApplication`, e.g. hive. But if the user has no permission to do kill, the error will be thrown.
```
Caused by: java.security.AccessControlException: User hive cannot perform operation MODIFY_APP on application_1649986670278_3655140
at org.apache.kyuubi.KyuubiSQLException$.apply(KyuubiSQLException.scala:69) ~[kyuubi-common_2.12-1.5.1-incubating.jar:1.5.1-incubating]
at org.apache.kyuubi.engine.ProcBuilder.$anonfun$start$1(ProcBuilder.scala:165) ~[kyuubi-server_2.12-1.5.1-incubating.jar:1.5.1-incubating]
```
So, if the engine is created and started through proxy user, we can also use proxy user to do the kill action.
### How should we improve?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
Contributor guide
Research direction
Start at the yarnClient.killApplication call and trace how the engine is created and started through a proxy user. Confirm the intended proxy identity and test that killing an application uses it when the current user lacks MODIFY_APP permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- hadoop, scala
- Domain
- backend, distributed-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100