What's new in YARN and YARN Queue Manager

Cloudera Runtime 7.3.2.10000 SP1

The following new properties and configyrations are introduced in this release:

MapReduce security allowed users property

Defines a list of trusted users permitted to bypass the denied-tasks list. Designed for system-level or administrative workflows requiring restricted task implementations, this setting skips blocklist validation for designated submitters while maintaining standard Hadoop ACL and authentication checks.

Table 1. Property name and its details

Property name	Property type	Default	Example
mapreduce.security.allowed-users	List of usernames	Empty	alice, bob

MapReduce task-level security enforcement

When enabled, the Application Master performs validation of user-submitted mapper, reducer, and other task-related classes before launching containers. This mechanism protects the cluster from running disallowed or unsafe task implementations as defined by administrator-controlled policies.

Table 2. Property name and its details

Property name	Property type	Default
mapreduce.security.enabled	boolean	false (security disabled)

MapReduce Security Property Domain

The property domain specifies the MapReduce configuration keys for user-defined class names, including mappers, reducers, and partitioners, that are executed during task runs. The Application Master inspects these property values to verify that no specified class matches the list of denied tasks. System administrators can customize this list to broaden or narrow the validation scope.

Table 3. Property name and its details

Property name	Property type	Default
mapreduce.security.property-domain	list of configuration keys	map.sort.classL

List of new configurations:

• mapreduce.job.classloader.system.classes
• mapreduce.job.combine.class
• mapreduce.job.combiner.group.comparator.class
• mapreduce.job.end-notification.custom-notifier-class
• mapreduce.job.inputformat.class
• mapreduce.job.map.class
• mapreduce.job.map.output.collector.class
• mapreduce.job.output.group.comparator.class
• mapreduce.job.output.key.class
• mapreduce.job.output.key.comparator.class
• mapreduce.job.output.value.class
• mapreduce.job.outputformat.class
• mapreduce.job.partitioner.class
• mapreduce.job.reduce.class
• mapreduce.map.output.key.class
• mapreduce.map.output.value.class

TLS 1.3 support

Ranger supports TLS 1.3 for stronger security and compliance.

Cloudera Runtime 7.3.2.100 CHF 1

There are no new features introduced in this release.

Cloudera Runtime 7.3.2

Hadoop rebase summary

In Cloudera Runtime 7.3.2, Apache Hadoop is rebased to version 3.4.1. The Apache Hadoop upgrade improves overall performance and includes all the new features, improvements, and bug fixes from versions 3.2, 3.3, and 3.4.

Table 4. Improvements added from Apache Hadoop 3.2 to 3.4 versions

Apache Hadoop version	Apache Jira	Name	Description
3.4	YARN-9279	YARN Hamlet Package Removal	The deprecated org.apache.hadoop.yarn.webapp.hamlet package is now completely removed to improve maintainability. This is an incompatible change in Hadoop YARN 3.4.0+. Applications relying on this old package must be updated to use the org.apache.hadoop.yarn.webapp.hamlet2 package. This affects the YARN webapp component.
3.4	YARN-10820	Enhanced Reliability for YARN node list Command	The thread-safety issue is fixed in GetClusterNodesRequestPBImpl, that previously caused intermittent failures, such as java.lang.ArrayIndexOutOfBoundsException, with the YARN node list command. This change affects the YARN client in Hadoop YARN 3.4.0, 3.3.2, and 3.2.4, thereby, eliminating random crashes when running the YARN node list command.

Table 5. Issues fixed between Apache Hadoop versions 3.2 to 3.4

Apache Hadoop version	Apache Jira	Name	Description
3.3	MAPREDUCE-6190	MapReduce task initialization Timeout issue	Previously, MapReduce jobs stopped responding if a task terminated before sending its first heartbeat, as the task never timed out and remained stuck indefinitely in a "STARTING" state. This issue is now resolved by introducing a dedicated timeout mechanism specifically designed to catch and terminate tasks that fail to initialize and send their first heartbeat.
3.4	YARN-9809	Miscommunication between RM and NM when NodeManagers are unhealthy	Previously, if a NodeManager (NM) was registered in an unhealthy state, it did not communicate the status immediately. As a result, the Resource Manager (RM) mistakenly scheduled many containers to that unhealthy node before the first heartbeat was received. Once the first heartbeat finally arrived, the RM recognize the unhealthy status and abruptly ended all the recently scheduled containers, causing unnecessary task failures and wasted resources. This issue is now resolved and NMs now explicitly supply their health status during their initial registration with the RM.