集群集成Kerberos过程中遇到的坑

1、hdfs用户提交mr作业无法运行

INFO mapreduce.Job: Job job_1442654915965_0002 failed with state
FAILED due to: Application application_1442654915965_0002 failed 2
times due to AM Container for appattempt_1442654915965_0002_000002
exited with exitCode: -1000 due to: Application
application_1442654915965_0002 initialization failed (exitCode=255)
with output: Requested user hdfs is not whitelisted and has id
496,which is below the minimum allowed 1000

原因：

Linux user 的 user id 要大于等于1000，否则会无法提交Job。例如，如果以hdfs（id为490）的身份提交一个job，就会看到以上的错误信息
解决方法：

1.使用命令 usermod -u 修改一个用户的user id
2.修改Clouder关于这个该项的设置，Yarn->配置->min.user.id修改为合适的值，当前为0

2、提交mr作业时可以运行但是有错误信息

INFO mapreduce.Job: Job job_1442722429197_0001 failed with state
FAILED due to: Application application_1442722429197_0001 failed 2
times due to AM Container for appattempt_1442722429197_0001_000002
exited with exitCode: -1000 due to: Application
application_1442722429197_0001 initialization failed (exitCode=255)
with output: Requested user hdfs is banned

原因：

hdfs用户被禁止运行 YARN container，yarn的设置中将hdfs用户禁用了
解决方法：

修改Clouder关于这个该项的设置，Yarn->配置->banned.users 将hdfs用户移除

3、YARN job运行时无法创建缓存目录
异常信息：
main : user is hdfs
main : requested yarn user is hdfs
Can’t create directory /data/data/yarn/nm/usercache/hdfs/appcache/application_1442724165689_0005 - Permission denied

原因：
该缓存目录在集群进入Kerberos状态前就已经存在了。例如当我们还没为集群Kerberos支持的时候，就用该用户跑过YARN应用

解决方法：

在每一个NodeManager节点上删除该用户的缓存目录，对于用户hdfs，是/data/data/yarn/nm/usercache/hdfs