Skip to content

Latest commit

 

History

History
84 lines (72 loc) · 4.36 KB

yarn.md

File metadata and controls

84 lines (72 loc) · 4.36 KB
Raw

YARN Support

The YARNContainerFactory enables launching action containers within a YARN cluster. It does not affect the deployment of OpenWhisk components (invoker, controller).

Enable

To enable YARNContainerFactory, use the following TypeSafe Config properties

property required details example
whisk.spi.ContainerFactoryProvider required enable the YARNContainerFactory org.apache.openwhisk.core.yarn.YARNContainerFactoryProvider
whisk.yarn.masterUrl required YARN Resource Manager endpoint to be accessed from the invoker http://localhost:8088
whisk.yarn.yarnLinkLogMessage optional (default true) Display a log message with a link to YARN when using the default LogStore (or no log message) true
whisk.yarn.serviceName optional (default openwhisk) Name of the YARN Service created by the invoker. The invoker number will be appended. openwhisk-action-service
whisk.yarn.authType optional (default simple) Authentication type for YARN simple or kerberos
whisk.yarn.kerberosPrincipal optional (default "") Kerberos principal to use for the YARN service. Note: must include a hostname user1/hostA@REALM
whisk.yarn.kerberosKeytabURI optional (default "") Location of keytab accessible by all node managers hdfs:/user/user1/user1_hostA.keytab
whisk.yarn.queue optional (default default) Name of the YARN queue where the service will be created default
whisk.yarn.memory optional (default 256) Memory used by each YARN container 256
whisk.yarn.cpus optional (default 1) CPUs used by each YARN container 1

To set these properties for your invoker, set the corresponding environment variables e.g.,

CONFIG_whisk_spi_ContainerFactoryProvider=org.apache.openwhisk.core.yarn.YARNContainerFactoryProvider
CONFIG_whisk_yarn_masterUrl=http://localhost:8088
CONFIG_whisk_yarn_yarnLinkLogMessage=true
CONFIG_whisk_yarn_serviceName=openwhisk-action-service
CONFIG_whisk_yarn_authType=simple

CONFIG_whisk_yarn_queue=default
CONFIG_whisk_yarn_memory=256
CONFIG_whisk_yarn_cpus=1

HA

HA is supported. Each invoker will create its own YARN service with its invoker number appended to the configured service name (e.g. openwhisk-action-service-0).

Security

By default, OpenWhisk does not authenticate when communicating with YARN. Optionally, Kerberos/SPNEGO authentication can be used via JaaS with a few steps:

  • Set whisk.yarn.authType to "kerberos"
  • Set the kerberosPrincipal and kerberosKeytabURI properties. These are used by the YARN service.
  • Mount krb5.conf, login.conf, and keytab files into the invoker's docker container. For example:
    • -v "/etc/krb5.conf:/etc/krb5.conf"
    • -v "/home/user1/login.conf:/login.conf"
    • -v "/home/user1/user1.keytab:/user1.keytab"
  • Run the invoker with the following java settings (e.g. via the INVOKER_OPTS environment variable):
    • -Djava.security.auth.login.config={Path to login.conf file}
    • -Djava.security.krb5.conf={Path to krb5.conf file}

Example login.conf:

com.sun.security.jgss.initiate {
     com.sun.security.auth.module.Krb5LoginModule required
     useKeyTab=true
     storeKey=true
     doNotPrompt=true
     keyTab="~/user1_hostA.keytab"
     principal="user1/hostA@REALM";
 };

Known Issues

  • Logs are not collected from action containers.

    For now, the YARN public URL will be included in the logs retrieved via the wsk CLI. Once log retrieval from external sources is enabled, logs from yarn containers would have to be routed to the external source, and then retrieved from that source.