The Yarn client should use the UGI who created the Yarn client for obtaining a delegation token for the remote log dir

Path remoteRootLogDir = fileController.getRemoteRootLogDir();
FileSystem fs = remoteRootLogDir.getFileSystem(conf);

final org.apache.hadoop.security.token.Token<?>[] finalTokens =
    fs.addDelegationTokens(masterPrincipal, credentials);

public FileSystem getFileSystem(Configuration conf) throws IOException {
  return FileSystem.get(this.toUri(), conf);
}

YarnClient yarnClient = ugi.doAs(new PrivilegedExceptionAction<YarnClient>() {
    @Override
    public YarnClient run() throws Exception {
        YarnClient yarnClient = YarnClient.createYarnClient();
        yarnClient.init(conf);
        yarnClient.start();
        return yarnClient;
    }
});

public YarnClient createYarnClient(UserGroupInformation ugi, Configuration conf) throws Exception {
    return ugi.doAs((PrivilegedExceptionAction<YarnClient>) () -> {
        // Her I am the submitterUser (see below)
        YarnClient yarnClient = YarnClient.createYarnClient();
        yarnClient.init(conf);
        yarnClient.start();
        return yarnClient;
    });
}

public void run() {
    // Here I am the serviceUser
    // ...
    Configuration conf = ...
    // ...
    UserGroupInformation ugi = getSubmitterUser();
    // ...
    YarnClient yarnClient = createYarnClient(ugi);
    // ...
    ApplicationSubmissionContext context = ...
    // ...
    yarnClient.submitApplication(context);
}