public LlapSigner getLlapSigner(final Configuration jobConf) {
    // Note that we create the cluster name from user conf (hence, a user can target a cluster),
    // but then we create the signer using hiveConf (hence, we control the ZK config and stuff).
    assert UserGroupInformation.isSecurityEnabled();
    final String clusterId = DaemonId.createClusterString(
        clusterUser, LlapUtil.generateClusterName(jobConf));
    try {
      return signers.get(clusterId, new Callable<LlapSigner>() {
        public LlapSigner call() throws Exception {
          return new LlapSignerImpl(hiveConf, clusterId);
        }
      });
    } catch (ExecutionException e) {
      throw new RuntimeException(e);
    }
  }
We'll keep signers per cluster around for some time, for reuse.
llap-client/src/java/org/apache/hadoop/hive/llap/coordinator/LlapCoordinator.java