[
https://issues.apache.org/jira/browse/MESOS-3062?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14635680#comment-14635680
]
Adam B commented on MESOS-3062:
-------------------------------
I agree with using the "framework principal", but for the operator endpoints,
it should be authorized against the authenticated http user, not just the
"master".
> Add authorization for dynamic reservation
> -----------------------------------------
>
> Key: MESOS-3062
> URL: https://issues.apache.org/jira/browse/MESOS-3062
> Project: Mesos
> Issue Type: Task
> Components: master
> Reporter: Michael Park
> Assignee: Michael Park
>
> Dynamic reservations should be authorized with the {{principal}} of the
> reserving entity (framework or master). The idea is to introduce {{Reserve}}
> and {{Unreserve}} into the ACL.
> {code}
> message Reserve {
> // Subjects.
> required Entity principals = 1;
> // Objects. MVP: Only possible values = ANY, NONE
> required Entity resources = 1;
> }
> message Unreserve {
> // Subjects.
> required Entity principals = 1;
> // Objects.
> required Entity reserver_principals = 2;
> }
> {code}
> When a framework/operator reserves resources, "reserve" ACLs are checked to
> see if the framework ({{FrameworkInfo.principal}}) or the operator
> ({{Credential.user}}) is authorized to reserve the specified resources. If
> not authorized, the reserve operation is rejected.
> When a framework/operator unreserves resources, "unreserve" ACLs are checked
> to see if the framework ({{FrameworkInfo.principal}}) or the operator
> ({{Credential.user}}) is authorized to unreserve the resources reserved by a
> framework or operator ({{Resource.ReservationInfo.principal}}). If not
> authorized, the unreserve operation is rejected.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
