apache / apache/kyuubi

[Improvement] Support kill yarn application through proxy user

Open
#2,698 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.

### What would you like to be improved?

Kyuubi always uses the current user to do `yarnClient.killApplication`, e.g. hive. But if the user has no permission to do kill, the error will be thrown.

```
Caused by: java.security.AccessControlException: User hive cannot perform operation MODIFY_APP on application_1649986670278_3655140
at org.apache.kyuubi.KyuubiSQLException$.apply(KyuubiSQLException.scala:69) ~[kyuubi-common_2.12-1.5.1-incubating.jar:1.5.1-incubating]
at org.apache.kyuubi.engine.ProcBuilder.$anonfun$start$1(ProcBuilder.scala:165) ~[kyuubi-server_2.12-1.5.1-incubating.jar:1.5.1-incubating]
```

So, if the engine is created and started through proxy user, we can also use proxy user to do the kill action.

### How should we improve?

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start at the yarnClient.killApplication call and trace how the engine is created and started through a proxy user. Confirm the intended proxy identity and test that killing an application uses it when the current user lacks MODIFY_APP permission.

Written by the indexing model from the issue text.

Assessment

Tech stack
hadoop, scala
Domain
backend, distributed-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.