Help Center/ MapReduce Service/ Component Operation Guide (LTS)/ Using YARN/ Yarn User Permission Management/ Creating Yarn Roles
Updated on 2024-10-09 GMT+08:00
View PDF
Share

Creating Yarn Roles

Scenario

Create and configure a YARN role. The Yarn role can be assigned with Yarn administrator permission and manage Yarn queue resources.

If the current component uses Ranger for permission control, you need to configure permission management policies based on Ranger. Refer to Adding a Ranger Access Permission Policy for Yarn.

Prerequisites

  • The MRS cluster administrator has understood service requirements.
  • You have logged in to Manager.

Procedure

  1. Choose System > Permission > Role.
  2. Click Create Role and set a role name and enter description.
  3. Refer Table 1 to configure resource permissions for roles.

    Yarn permissions:

    • Cluster management: Yarn administrator permissions.
    • Queue scheduling: queue resource management.
      Table 1 Setting a role

      Task

      Operation

      Setting the Yarn administrator permission

      In the Configure Resource Permission table, choose Name of the desired cluster > Yarn > Cluster Management.

      NOTE:

      The Yarn service needs to be restarted to set the Yarn administrator permission so that the saved role configuration can take effect.

      Setting the permission for a user to submit tasks in a specified Yarn queue
      1. In the Configure Resource Permission table, choose Name of the desired cluster > Yarn > Scheduling Queue > root.
      2. In the Permission column of the specified queue, select Submit.

      Setting the permission for a user to manage tasks in a specified Yarn queue
      1. In the Configure Resource Permission table, choose Name of the desired cluster > Yarn > Scheduling Queue > root.
      2. In the Permission column of the specified queue, select Manage.

    If the Yarn role contains the Submit or Manage permission of a parent queue, the sub-queue inherits the permission by default, that is, the Submit or Manage permission is automatically added for the sub-queue. Permissions inherited by sub-queues will not be displayed as selected in the Configure Resource Permission table.

    If you select only the Submit permission of a parent queue when setting the Yarn role, you need to manually specify the queue name when submitting tasks as a user with the permission of this role. Otherwise, when the parent queue has multiple sub-queues, the system does not automatically determine the queue to which the task is submitted and therefore submits the task to the default queue.

  4. Click OK.