This is an automated email from the ASF dual-hosted git repository.
caishunfeng pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/dolphinscheduler.git
The following commit(s) were added to refs/heads/dev by this push:
new af55f94cc0 Fix sudo enable is false will still check tenant exist
(#16071)
af55f94cc0 is described below
commit af55f94cc00756abf819a33d876b3cb97f32d4ae
Author: Wenjun Ruan <[email protected]>
AuthorDate: Mon May 27 18:34:14 2024 +0800
Fix sudo enable is false will still check tenant exist (#16071)
(cherry picked from commit c5baa75ef93243c6bf88194eb3ad94a48173a003)
---
deploy/kubernetes/dolphinscheduler/README.md | 1 -
deploy/kubernetes/dolphinscheduler/values.yaml | 2 -
docs/docs/en/architecture/configuration.md | 1 -
docs/docs/zh/architecture/configuration.md | 1 -
.../common/constants/TenantConstants.java | 2 +-
.../server/worker/config/TenantConfig.java | 1 -
.../server/worker/runner/WorkerTaskExecutor.java | 4 +-
.../TaskInstanceDispatchOperationFunction.java | 1 -
.../worker/utils/TaskExecutionContextUtils.java | 42 ----------
.../server/worker/utils/TenantUtils.java | 95 ++++++++++++++++++++++
.../src/main/resources/application.yaml | 2 -
11 files changed, 98 insertions(+), 54 deletions(-)
diff --git a/deploy/kubernetes/dolphinscheduler/README.md
b/deploy/kubernetes/dolphinscheduler/README.md
index 209e4e3942..4b83f5b160 100644
--- a/deploy/kubernetes/dolphinscheduler/README.md
+++ b/deploy/kubernetes/dolphinscheduler/README.md
@@ -308,7 +308,6 @@ Please refer to the [Quick Start in
Kubernetes](../../../docs/docs/en/guide/inst
|
worker.env.WORKER_SERVER_LOAD_PROTECTION_MAX_SYSTEM_CPU_USAGE_PERCENTAGE_THRESHOLDS
| float | `0.7` | Worker max system cpu usage, when the worker's system cpu
usage is smaller then this value, worker server can be dispatched tasks. |
|
worker.env.WORKER_SERVER_LOAD_PROTECTION_MAX_SYSTEM_MEMORY_USAGE_PERCENTAGE_THRESHOLDS
| float | `0.7` | Worker max memory usage , when the worker's memory usage is
smaller then this value, worker server can be dispatched tasks. |
| worker.env.WORKER_TENANT_CONFIG_AUTO_CREATE_TENANT_ENABLED | bool | `true` |
tenant corresponds to the user of the system, which is used by the worker to
submit the job. If system does not have this user, it will be automatically
created after the parameter worker.tenant.auto.create is true. |
-| worker.env.WORKER_TENANT_CONFIG_DISTRIBUTED_TENANT | bool | `false` | Scenes
to be used for distributed users. For example, users created by FreeIpa are
stored in LDAP. This parameter only applies to Linux, When this parameter is
true, worker.tenant.auto.create has no effect and will not automatically create
tenants. |
| worker.keda.advanced | object | `{}` | Specify HPA related options |
| worker.keda.cooldownPeriod | int | `30` | How many seconds KEDA will wait
before scaling to zero. Note that HPA has a separate cooldown period for
scale-downs |
| worker.keda.enabled | bool | `false` | Enable or disable the Keda component |
diff --git a/deploy/kubernetes/dolphinscheduler/values.yaml
b/deploy/kubernetes/dolphinscheduler/values.yaml
index 3481d600fe..e7e42c6d09 100644
--- a/deploy/kubernetes/dolphinscheduler/values.yaml
+++ b/deploy/kubernetes/dolphinscheduler/values.yaml
@@ -654,8 +654,6 @@ worker:
WORKER_HOST_WEIGHT: "100"
# -- tenant corresponds to the user of the system, which is used by the
worker to submit the job. If system does not have this user, it will be
automatically created after the parameter worker.tenant.auto.create is true.
WORKER_TENANT_CONFIG_AUTO_CREATE_TENANT_ENABLED: true
- # -- Scenes to be used for distributed users. For example, users created
by FreeIpa are stored in LDAP. This parameter only applies to Linux, When this
parameter is true, worker.tenant.auto.create has no effect and will not
automatically create tenants.
- WORKER_TENANT_CONFIG_DISTRIBUTED_TENANT: false
# -- If set true, will use worker bootstrap user as the tenant to execute
task when the tenant is `default`;
DEFAULT_TENANT_ENABLED: false
diff --git a/docs/docs/en/architecture/configuration.md
b/docs/docs/en/architecture/configuration.md
index a490e47d89..16fc7899d9 100644
--- a/docs/docs/en/architecture/configuration.md
+++ b/docs/docs/en/architecture/configuration.md
@@ -328,7 +328,6 @@ Location: `worker-server/conf/application.yaml`
| worker.registry-disconnect-strategy.max-waiting-time
| 100s | Used when the worker disconnect from registry, and the
disconnect strategy is waiting, this config means the worker will waiting to
reconnect to registry in given times, and after the waiting times, if the
worker still cannot connect to registry, will stop itself, if the value is 0s,
will wait infinitely |
| worker.task-execute-threads-full-policy
| REJECT | If REJECT, when the task waiting in the worker reaches
exec-threads, it will reject the received task and the Master will redispatch
it; If CONTINUE, it will put the task into the worker's execution queue and
wait for a free thread to start execution
|
| worker.tenant-config.auto-create-tenant-enabled
| true | tenant corresponds to the user of the system, which is used
by the worker to submit the job. If system does not have this user, it will be
automatically created after the parameter worker.tenant.auto.create is true.
|
-| worker.tenant-config.distributed-tenant-enabled
| false | When this parameter is true, auto-create-tenant-enabled has
no effect and will not automatically create tenants
|
| worker.tenant-config.default-tenant-enabled
| false | If set true, will use worker bootstrap user as the tenant to
execute task when the tenant is `default`.
|
### Alert Server related configuration
diff --git a/docs/docs/zh/architecture/configuration.md
b/docs/docs/zh/architecture/configuration.md
index 3e40b8d88f..d377e2ed97 100644
--- a/docs/docs/zh/architecture/configuration.md
+++ b/docs/docs/zh/architecture/configuration.md
@@ -331,7 +331,6 @@ common.properties配置文件目前主要是配置hadoop/s3/yarn/applicationId
| worker.registry-disconnect-strategy.max-waiting-time
| 100s | 当Worker与注册中心失联之后重连时间, 之后当strategy为waiting时，该值生效。
该值表示当Worker与注册中心失联时会在给定时间之内进行重连,
在给定时间之内重连失败将会停止自己，在重连时，Worker会丢弃kill正在执行的任务。值为0表示会无限期等待 |
| worker.task-execute-threads-full-policy
| REJECT | 如果是 REJECT, 当Worker中等待队列中的任务数达到exec-threads时,
Worker将会拒绝接下来新接收的任务，Master将会重新分发该任务; 如果是 CONTINUE,
Worker将会接收任务，放入等待队列中等待空闲线程去执行该任务 |
| worker.tenant-config.auto-create-tenant-enabled
| true |
租户对应于系统的用户,由worker提交作业.如果系统没有该用户,则在参数worker.tenant.auto.create为true后自动创建。
|
-| worker.tenant-config.distributed-tenant-enabled
| false | 如果设置为true, auto-create-tenant-enabled 将会不起作用。
|
| worker.tenant-config.default-tenant-enabled
| false | 如果设置为true, 将会使用worker服务启动用户作为 `default` 租户。
|
## Alert Server相关配置
diff --git
a/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/TenantConstants.java
b/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/TenantConstants.java
index 8bffd5429e..aa905cbb72 100644
---
a/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/TenantConstants.java
+++
b/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/TenantConstants.java
@@ -21,5 +21,5 @@ public class TenantConstants {
public static final String DEFAULT_TENANT_CODE = "default";
- public static final String BOOTSTRAPT_SYSTEM_USER =
System.getProperty("user.name");
+ public static final String BOOTSTRAP_SYSTEM_USER =
System.getProperty("user.name");
}
diff --git
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/config/TenantConfig.java
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/config/TenantConfig.java
index 9d2753f88d..ef539be59d 100644
---
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/config/TenantConfig.java
+++
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/config/TenantConfig.java
@@ -23,6 +23,5 @@ import lombok.Data;
public class TenantConfig {
private boolean autoCreateTenantEnabled = true;
- private boolean distributedTenantEnabled = false;
private boolean defaultTenantEnabled = false;
}
diff --git
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/WorkerTaskExecutor.java
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/WorkerTaskExecutor.java
index e64a421001..604b0b5743 100644
---
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/WorkerTaskExecutor.java
+++
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/WorkerTaskExecutor.java
@@ -53,6 +53,7 @@ import
org.apache.dolphinscheduler.server.worker.registry.WorkerRegistryClient;
import org.apache.dolphinscheduler.server.worker.rpc.WorkerMessageSender;
import
org.apache.dolphinscheduler.server.worker.utils.TaskExecutionContextUtils;
import org.apache.dolphinscheduler.server.worker.utils.TaskFilesTransferUtils;
+import org.apache.dolphinscheduler.server.worker.utils.TenantUtils;
import java.io.File;
import java.io.IOException;
@@ -209,8 +210,7 @@ public abstract class WorkerTaskExecutor implements
Runnable {
// In most of case the origin tenant is the same as the current tenant
// Except `default` tenant. The originTenant is used to download the
resources
String originTenant = taskExecutionContext.getTenantCode();
- String tenant =
TaskExecutionContextUtils.getOrCreateTenant(workerConfig, taskExecutionContext);
- taskExecutionContext.setTenantCode(tenant);
+
taskExecutionContext.setTenantCode(TenantUtils.getOrCreateActualTenant(workerConfig,
taskExecutionContext));
log.info("TenantCode: {} check successfully",
taskExecutionContext.getTenantCode());
TaskExecutionContextUtils.createTaskInstanceWorkingDirectory(taskExecutionContext);
diff --git
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/operator/TaskInstanceDispatchOperationFunction.java
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/operator/TaskInstanceDispatchOperationFunction.java
index fc128a9a34..bf92349323 100644
---
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/operator/TaskInstanceDispatchOperationFunction.java
+++
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/runner/operator/TaskInstanceDispatchOperationFunction.java
@@ -79,7 +79,6 @@ public class TaskInstanceDispatchOperationFunction
WorkerTaskExecutor workerTaskExecutor =
workerTaskExecutorFactoryBuilder
.createWorkerTaskExecutorFactory(taskExecutionContext).createWorkerTaskExecutor();
- // todo: hold the workerTaskExecutor
if
(!workerTaskExecutorThreadPool.submitWorkerTaskExecutor(workerTaskExecutor)) {
log.info("Submit task: {} to wait queue failed",
taskExecutionContext.getTaskName());
return
TaskInstanceDispatchResponse.failed(taskExecutionContext.getTaskInstanceId(),
diff --git
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TaskExecutionContextUtils.java
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TaskExecutionContextUtils.java
index 8d83dde593..1b486f265c 100644
---
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TaskExecutionContextUtils.java
+++
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TaskExecutionContextUtils.java
@@ -17,9 +17,7 @@
package org.apache.dolphinscheduler.server.worker.utils;
-import org.apache.dolphinscheduler.common.constants.TenantConstants;
import org.apache.dolphinscheduler.common.utils.FileUtils;
-import org.apache.dolphinscheduler.common.utils.OSUtils;
import org.apache.dolphinscheduler.plugin.storage.api.StorageOperate;
import org.apache.dolphinscheduler.plugin.task.api.TaskChannel;
import org.apache.dolphinscheduler.plugin.task.api.TaskException;
@@ -28,12 +26,9 @@ import
org.apache.dolphinscheduler.plugin.task.api.model.ResourceInfo;
import
org.apache.dolphinscheduler.plugin.task.api.parameters.AbstractParameters;
import org.apache.dolphinscheduler.plugin.task.api.parameters.ParametersNode;
import org.apache.dolphinscheduler.plugin.task.api.resource.ResourceContext;
-import org.apache.dolphinscheduler.server.worker.config.TenantConfig;
-import org.apache.dolphinscheduler.server.worker.config.WorkerConfig;
import org.apache.dolphinscheduler.server.worker.metrics.WorkerServerMetrics;
import org.apache.commons.collections4.CollectionUtils;
-import org.apache.commons.lang3.SystemUtils;
import java.io.File;
import java.nio.file.Files;
@@ -45,43 +40,6 @@ import lombok.extern.slf4j.Slf4j;
@Slf4j
public class TaskExecutionContextUtils {
- public static String getOrCreateTenant(WorkerConfig workerConfig,
TaskExecutionContext taskExecutionContext) {
- try {
- TenantConfig tenantConfig = workerConfig.getTenantConfig();
-
- String tenantCode = taskExecutionContext.getTenantCode();
- if (TenantConstants.DEFAULT_TENANT_CODE.equals(tenantCode) &&
tenantConfig.isDefaultTenantEnabled()) {
- log.info("Current tenant is default tenant, will use bootstrap
user: {} to execute the task",
- TenantConstants.BOOTSTRAPT_SYSTEM_USER);
- return TenantConstants.BOOTSTRAPT_SYSTEM_USER;
- }
- boolean osUserExistFlag;
- // if Using distributed is true and Currently supported systems
are linux,Should not let it
- // automatically
- // create tenants,so TenantAutoCreate has no effect
- if (tenantConfig.isDistributedTenantEnabled() &&
SystemUtils.IS_OS_LINUX) {
- // use the id command to judge in linux
- osUserExistFlag = OSUtils.existTenantCodeInLinux(tenantCode);
- } else if (OSUtils.isSudoEnable() &&
tenantConfig.isAutoCreateTenantEnabled()) {
- // if not exists this user, then create
- OSUtils.createUserIfAbsent(tenantCode);
- osUserExistFlag = OSUtils.getUserList().contains(tenantCode);
- } else {
- osUserExistFlag = OSUtils.getUserList().contains(tenantCode);
- }
- if (!osUserExistFlag) {
- throw new TaskException(
- String.format("TenantCode: %s doesn't exist",
tenantCode));
- }
- return tenantCode;
- } catch (TaskException ex) {
- throw ex;
- } catch (Exception ex) {
- throw new TaskException(
- String.format("TenantCode: %s doesn't exist",
taskExecutionContext.getTenantCode()), ex);
- }
- }
-
public static void createTaskInstanceWorkingDirectory(TaskExecutionContext
taskExecutionContext) throws TaskException {
// local execute path
String taskInstanceWorkingDirectory =
FileUtils.getTaskInstanceWorkingDirectory(
diff --git
a/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TenantUtils.java
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TenantUtils.java
new file mode 100644
index 0000000000..0b0bba7484
--- /dev/null
+++
b/dolphinscheduler-worker/src/main/java/org/apache/dolphinscheduler/server/worker/utils/TenantUtils.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.dolphinscheduler.server.worker.utils;
+
+import org.apache.dolphinscheduler.common.constants.TenantConstants;
+import org.apache.dolphinscheduler.common.utils.OSUtils;
+import org.apache.dolphinscheduler.plugin.task.api.TaskException;
+import org.apache.dolphinscheduler.plugin.task.api.TaskExecutionContext;
+import org.apache.dolphinscheduler.server.worker.config.TenantConfig;
+import org.apache.dolphinscheduler.server.worker.config.WorkerConfig;
+
+import lombok.experimental.UtilityClass;
+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+@UtilityClass
+public class TenantUtils {
+
+ public static boolean isTenantEnable() {
+ // todo: add tenantEnable in workerConfig, the tenantEnable shouldn't
judged by sudoEnable, these should be two
+ // config
+ return OSUtils.isSudoEnable();
+ }
+
+ /**
+ * Get the the actual tenant code or create the tenant if it doesn't exist.
+ * <p>
+ * If sudo is enabled then will check tenant.
+ * If the tenant code is the default tenant code and the {@link
TenantConfig#isDefaultTenantEnabled()} is enabled, will return the bootstrap
user.
+ * If the tenant code is not the default tenant code, will check if the
tenant exist, if the tenant is not exist and {@link
TenantConfig#isAutoCreateTenantEnabled()} is true will create the tenant.
+ * <p>
+ * If sudo is not enabled, will not check the tenant code.
+ */
+ public static String getOrCreateActualTenant(WorkerConfig workerConfig,
TaskExecutionContext taskExecutionContext) {
+ TenantConfig tenantConfig = workerConfig.getTenantConfig();
+
+ if (!isTenantEnable()) {
+ log.info("Tenant is not enabled, will use the bootstrap: {} user
as tenant", getBootstrapTenant());
+ return getBootstrapTenant();
+ }
+
+ String tenantCode = taskExecutionContext.getTenantCode();
+ if (isDefaultTenant(tenantCode)) {
+ if (tenantConfig.isDefaultTenantEnabled()) {
+ log.info("Current tenant is default tenant, will use bootstrap
user: {} to execute the task",
+ getBootstrapTenant());
+ return getBootstrapTenant();
+ } else {
+ throw new TaskException(
+ "The tenantCode is " + tenantCode + ", please enable
TenantConfig#isDefaultTenantEnabled");
+ }
+ }
+
+ if (tenantConfig.isAutoCreateTenantEnabled()) {
+ OSUtils.createUserIfAbsent(tenantCode);
+ }
+
+ if (!tenantExists(tenantCode)) {
+ throw new TaskException(String.format("TenantCode: %s doesn't
exist", tenantCode));
+ }
+ return tenantCode;
+ }
+
+ public static boolean isDefaultTenant(String tenantCode) {
+ return TenantConstants.DEFAULT_TENANT_CODE.equals(tenantCode);
+ }
+
+ public static String getBootstrapTenant() {
+ return TenantConstants.BOOTSTRAP_SYSTEM_USER;
+ }
+
+ public static boolean isBootstrapTenant(String tenantCode) {
+ return TenantConstants.BOOTSTRAP_SYSTEM_USER.equals(tenantCode);
+ }
+
+ public static boolean tenantExists(String tenantCode) {
+ return OSUtils.getUserList().contains(tenantCode);
+ }
+
+}
diff --git a/dolphinscheduler-worker/src/main/resources/application.yaml
b/dolphinscheduler-worker/src/main/resources/application.yaml
index 4361e8f014..a4a7476984 100644
--- a/dolphinscheduler-worker/src/main/resources/application.yaml
+++ b/dolphinscheduler-worker/src/main/resources/application.yaml
@@ -67,8 +67,6 @@ worker:
tenant-config:
# tenant corresponds to the user of the system, which is used by the
worker to submit the job. If system does not have this user, it will be
automatically created after the parameter worker.tenant.auto.create is true.
auto-create-tenant-enabled: true
- # Scenes to be used for distributed users. For example, users created by
FreeIpa are stored in LDAP. This parameter only applies to Linux, When this
parameter is true, auto-create-tenant-enabled has no effect and will not
automatically create tenants.
- distributed-tenant-enabled: false
# If set true, will use worker bootstrap user as the tenant to execute
task when the tenant is `default`.
default-tenant-enabled: false
