{"record":{"id":"1d943098e56944a2","repo":"apache/hadoop","slug":"can-t-get-master-kerberos-principal-for-the-rm-to","errorCode":null,"errorMessage":"Can't get Master Kerberos principal for the RM to use as renewer","messagePattern":"Can't get Master Kerberos principal for the RM to use as renewer","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-dynamometer/hadoop-dynamometer-infra/src/main/java/org/apache/hadoop/tools/dynamometer/Client.java","lineNumber":608,"sourceCode":"    // Set the necessary command to execute the application master\n    amContainer.setCommands(getAMCommand());\n\n    Resource capability = Records.newRecord(Resource.class);\n    capability.setMemorySize(amMemory);\n    capability.setVirtualCores(amVCores);\n    appContext.setResource(capability);\n\n    // Setup security tokens\n    if (UserGroupInformation.isSecurityEnabled()) {\n      ByteBuffer fsTokens;\n      if (tokenFileLocation != null) {\n        fsTokens = ByteBuffer\n            .wrap(Files.readAllBytes(Paths.get(tokenFileLocation)));\n      } else {\n        Credentials credentials = new Credentials();\n        String tokenRenewer = getConf().get(YarnConfiguration.RM_PRINCIPAL);\n        if (tokenRenewer == null || tokenRenewer.length() == 0) {\n          throw new IOException(\"Can't get Master Kerberos principal for the \"\n              + \"RM to use as renewer\");\n        }\n\n        // For now, only getting tokens for the default file-system.\n        final Token<?>[] tokens = fs.addDelegationTokens(tokenRenewer,\n            credentials);\n        if (tokens != null) {\n          for (Token<?> token : tokens) {\n            LOG.info(\"Got dt for \" + fs.getUri() + \"; \" + token);\n          }\n        }\n        DataOutputBuffer dob = new DataOutputBuffer();\n        credentials.writeTokenStorageToStream(dob);\n        fsTokens = ByteBuffer.wrap(dob.getData(), 0, dob.getLength());\n      }\n      amContainer.setTokens(fsTokens);\n    }\n","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-dynamometer/hadoop-dynamometer-infra/src/main/java/org/apache/hadoop/tools/dynamometer/Client.java#L590-L626","documentation":"Error \"Can't get Master Kerberos principal for the RM to use as renewer\" thrown in apache/hadoop.","triggerScenarios":"In a Kerberos-enabled deployment the dynamometer Client cannot resolve the ResourceManager master principal to use as a token renewer, typically because yarn-site.xml is missing yarn.resourcemanager.principal or the principal is misconfigured.","commonSituations":"See trigger scenarios.","solutions":["Configure yarn.resourcemanager.principal (and matching keytab) so the RM renewer principal can be resolved in a secure cluster."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}