[
https://issues.apache.org/jira/browse/MESOS-8306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16286750#comment-16286750
]
Yan Xu commented on MESOS-8306:
-------------------------------
So in order to authorize the static reservations, the master would be
configured to use the {{reserve_resources}} ACL against the agent's principal
like this:
{code:title=}
"register_agents": [
{
"principals": { "values": ["low-security-agent", "high-security-agent"] },
"agents": { "type": "ANY" }
},
{
"principals": { "type": "ANY" },
"agents": { "type": "NONE" }
}
],
"reserve_resources": [
{
"principals": { "values": ["high-security-agent"] },
"roles": { "type": "high-security-role" }
},
{
"principals": { "type": "NONE" },
"roles": { "type": "high-security-role" }
}
]
{code}
As part of agent registration, both of the two ACLs are going to be checked.
If a {{low-security-agent}} principal is comprised, it cannot reserve resources
of the {{high-security-role}} role.
> Restrict which agents can statically reserve resources for which roles
> ----------------------------------------------------------------------
>
> Key: MESOS-8306
> URL: https://issues.apache.org/jira/browse/MESOS-8306
> Project: Mesos
> Issue Type: Improvement
> Reporter: Yan Xu
> Assignee: Yan Xu
>
> In some use cases part of a Mesos cluster could be reserved for certain
> frameworks/roles. A common approach is to use static reservation so the
> resources of an agent are only offered to frameworks of the designated roles.
> However without proper authorization any (compromised) agent can register
> with these special roles and accept workload from these frameworks.
> We can enhance the {{RegisterAgent}} ACL to express: agent principal {{foo}}
> is allowed to register with static reservation roles {{bar, baz}}; no other
> principals are allowed to register with static reservation roles {{bar, baz}}.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
