<p>I have set up Spark Standalone cluster on Kubernetes, and I am trying to connect to a Kerberized Hadoop cluster which is NOT on Kubernetes. I have placed core-site.xml and hdfs-site.xml in my Spark cluster's container and have set HADOOP_CONF_DIR accordingly. I am able to successfully generate the kerberos credential cache in the Spark container for principal which accesses the Hadoop cluster. But when I run spark-submit, it fails with below Access control exception in worker. <strong>Note -</strong> master and workers are running in separate Kubernetes pods.</p>

<pre><code>spark-submit --master spark://master-svc:7077 --class myMainClass myApp.jar
Client cannot authenticate via: [TOKEN, KERBEROS] 
</code></pre>

<p>However, when I run spark-submit from the Spark container in local mode, it's able to talk to Hadoop cluster successfully.</p>

<pre><code>spark-submit --master local[*] --class myMainClass myApp.jar
</code></pre>

<p>Is there any configuration I need to set to make Worker use the credential cache in Spark Stand alone mode? </p>

<p>You have a huge problem: AFAIK Spark Standalone does not handle any kind of authentication.</p>

<ul>
<li>in <code>local</code> mode, the Spark client/driver/executors all live in the same JVM, the Hadoop client libs can access directly the Kerberos ticket present in the local cache (hence Spark doesn't have to manage anything)</li>
<li>in <code>yarn-cluster</code> mode, the Spark client uses the local Kerberos ticket to connect to Hadoop services and retrieve special <strong>auth tokens</strong> that are then shipped to the YARN container running the driver; then the driver broadcasts the token to the executors</li>
<li>in <code>yarn-client</code> mode it's similar with a shortcut, as the Spark driver runs with the client and has the token already available</li>
<li>with Spark Standalone you are screwed.</li>
</ul>

<p>Cf. <a href="https://stackoverflow.com/a/44290544/5162372">https://stackoverflow.com/a/44290544/5162372</a> for more details about Kerberos auth to Hive or HBase from Spark in <code>yarn-*</code> modes.</p>

<p>Cf. also the <code>--principal</code> and <code>--keytab</code> params needed by long-running jobs (e.g. Streaming) that need to renew their Kerberos creds on-the-fly, from within the driver (since the Spark client has probably terminated just after launch)</p>

<hr>

<p>Maybe you could try <code>spark.yarn.access.namenodes</code> to see if that forces the Spark client to fetch "additional" Kerberos tokens, but I would not bet on it, since that property will probably be ignored in Spark Standalone mode.</p>

<p>Cf. the comment by Steve Loughran on <a href="https://stackoverflow.com/questions/42650562/access-a-secured-hive-when-running-spark-in-an-unsecured-yarn-cluster">Access a secured Hive when running Spark in an unsecured YARN cluster</a></p>
