>  I'm not sure what's the objective of calling createRemoteUser() here.
In non-secure mode, the process runs as "yarn", but needs to interact with HDFS as the app user.

> But to address @pwendell's comments about tokens, there should be code somewhere that's renewing the kerberos ticket (by calling UserGroupInformation.reloginFromKeytab() at appropriate periods).
On YARN, neither the driver nor the container will necessarily have keytabs.  They authenticate using delegation tokens, which currently don't get replaced.