[
https://issues.apache.org/jira/browse/MESOS-5336?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15279881#comment-15279881
]
Alexander Rukletsov commented on MESOS-5336:
--------------------------------------------
Currently we have {{SET_QUOTA_WITH_ROLE}} and {{DESTROY_QUOTA_WITH_PRINCIPAL}}
authz actions, which will be eventually subsumed by a single
{{UPDATE_QUOTA_WITH_ROLE}} for all {{POST}}, {{PUT}}, and {{DELETE}}. These are
fine-grained authz actions.
We can additionally implement coarse-grained authz actions:
{{GET_ENDPOINT_WITH_PATH}}, {{POST_ENDPOINT_WITH_PATH}} and so on for
{{/quota}}. I can see benefits of having both coarse- and fine- grained authz
actions, but maybe we don't need to implement them now.
For now, let's either do {{GET_ENDPOINT_WITH_PATH}} or {{GET_QUOTA_WITH_ROLE}}.
The former does not allow fine-grained filtering, while the latter is harder to
implement since we have to filter quotas based on authorizer's response.
I see you have opted for {{GET_ENDPOINT_WITH_PATH}}. Do you think we can
implement the latter fast enough? For now, we'll have to query authorizer for
each role, but in the future we should be able to send a BatchRequest.
> Add authorization to GET /quota
> -------------------------------
>
> Key: MESOS-5336
> URL: https://issues.apache.org/jira/browse/MESOS-5336
> Project: Mesos
> Issue Type: Improvement
> Components: master, security
> Reporter: Adam B
> Labels: mesosphere, security
> Fix For: 0.29.0
>
>
> We already authorize which http users can set/remove quota for particular
> roles, but even knowing of the existence of these roles (let alone their
> quotas) may be sensitive information. We should add authz around GET
> operations on /quota.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
