[
https://issues.apache.org/jira/browse/MESOS-3065?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15004758#comment-15004758
]
Greg Mann edited comment on MESOS-3065 at 11/13/15 9:39 PM:
------------------------------------------------------------
Reviews here:
Added ACL protobuf messages 'CreateVolume' and 'DestroyVolume':
https://reviews.apache.org/r/40167/
Added 'CreateVolume' and 'DestroyVolume' ACL support to the authorizer:
https://reviews.apache.org/r/40168/
Added 'Master::authorizeDestroy/CreateVolume' to create/destroy persistent
volumes: https://reviews.apache.org/r/40169/
Added framework authorization for persistent volumes:
https://reviews.apache.org/r/40255/
Fixed handling of multiple offer operations in
PersistentVolumeTest.SendingCheckpointResourcesMessage:
https://reviews.apache.org/r/40256/
Added documentation for RESERVE, UNRESERVE, CREATE, and DESTROY authorization:
https://reviews.apache.org/r/40271/
was (Author: greggomann):
Reviews here:
Added ACL protobuf messages 'CreateVolume' and 'DestroyVolume':
https://reviews.apache.org/r/40167/
Added 'CreateVolume' and 'DestroyVolume' ACL support to the authorizer:
https://reviews.apache.org/r/40168/
Added 'Master::authorize{Destroy,Create}Volume' to create/destroy persistent
volumes: https://reviews.apache.org/r/40169/
Added framework authorization for persistent volumes:
https://reviews.apache.org/r/40255/
Fixed handling of multiple offer operations in
PersistentVolumeTest.SendingCheckpointResourcesMessage:
https://reviews.apache.org/r/40256/
Added documentation for RESERVE, UNRESERVE, CREATE, and DESTROY authorization:
https://reviews.apache.org/r/40271/
> Add framework authorization for persistent volume
> -------------------------------------------------
>
> Key: MESOS-3065
> URL: https://issues.apache.org/jira/browse/MESOS-3065
> Project: Mesos
> Issue Type: Task
> Reporter: Michael Park
> Assignee: Greg Mann
> Labels: mesosphere, persistent-volumes
>
> Persistent volume should be authorized with the {{principal}} of the
> reserving entity (framework or master). The idea is to introduce {{Create}}
> and {{Destroy}} into the ACL.
> {code}
> message Create {
> // Subjects.
> required Entity principals = 1;
> // Objects? Perhaps the kind of volume? allowed permissions?
> }
> message Destroy {
> // Subjects.
> required Entity principals = 1;
> // Objects.
> required Entity creator_principals = 2;
> }
> {code}
> When a framework creates a persistent volume, "create" ACLs are checked to
> see if the framework (FrameworkInfo.principal) or the operator
> (Credential.user) is authorized to create persistent volumes. If not
> authorized, the create operation is rejected.
> When a framework destroys a persistent volume, "destroy" ACLs are checked to
> see if the framework (FrameworkInfo.principal) or the operator
> (Credential.user) is authorized to destroy the persistent volume created by a
> framework or operator (Resource.DiskInfo.principal). If not authorized, the
> destroy operation is rejected.
> A separate ticket will use the structures created here to enable
> authorization of the "/create" and "/destroy" HTTP endpoints:
> https://issues.apache.org/jira/browse/MESOS-3903
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
