Re: Dynamic vs. implicit roles

2015-11-30 Thread Neil Conway
Hi Klaus, Thanks for your feedback. On Mon, Nov 30, 2015 at 10:01 PM, Klaus Ma wrote: > @Neil, just want to confirm about ACL, do you mean we will load role info > from 3rd part application, e.g. LDAP? I mean ACLs as in the authorization subsystem in Mesos: https://mesos.apache.org/documentatio

Re: Fw: Re: Dynamic vs. implicit roles

2015-11-30 Thread Neil Conway
On Mon, Nov 30, 2015 at 6:53 PM, YongQiao Wang wrote: >> 1. Choosing a role name >> 2. Configuring weights, ACLs, and quotas for the role. >> 3. Configuring applications/frameworks to register using that role. > > [Yong Qiao] If applications/frameworks do not follow your rules, and > register with

FOSDEM 2016 - take action by 4th of December 2015

2015-11-30 Thread Roman Shaposhnik
As most of you probably know FOSDEM 2016 (the biggest, 100% free open source developer conference) is right around the corner: https://fosdem.org/2016/ We hope to have an ASF booth and we would love to see as many ASF projects as possible present at various tracks (AKA Developer rooms): htt

Re: Dynamic vs. implicit roles

2015-11-30 Thread Klaus Ma
@Neil, just want to confirm about ACL, do you mean we will load role info from 3rd part application, e.g. LDAP? And as I mentioned in both design doc, why not build a RoleManager as plugin for them? Both features are required following operator: 1. check: check whether role is available 2. create:

Re: Dynamic vs. implicit roles

2015-11-30 Thread James Peach
> On Nov 30, 2015, at 6:53 PM, YongQiao Wang wrote: > > Hi All, > > Currently, there are two proposals on how to improve role management in > Mesos: > > (a) Dynamic roles (MESOS-3177): roles are stored in the registry > and queried/added/deleted/removed via HTTP endpoints. I posted a design do

Fwd: Fw: Re: Dynamic vs. implicit roles

2015-11-30 Thread YongQiao Wang
Hi All, Currently, there are two proposals on how to improve role management in Mesos: (a) Dynamic roles (MESOS-3177): roles are stored in the registry and queried/added/deleted/removed via HTTP endpoints. I posted a design doc here: https://docs.google.com/document/d/1OIgceqpsjV3-_LGF83IMAFnrh1E

Re: Injecting data into mesos container

2015-11-30 Thread Adam Medziński
My fault, my description of the problem was too general. I need to pass confidential data to Mesos task in a secure manner. By that data I mean credentials (private keys, password etc.) to other company systems that are generated for a particular task on Mesos. To run tasks we use Marathon framewor

Re: Injecting data into mesos container

2015-11-30 Thread tommy xiao
Hi Adam, could you please give more details on your env. what your mean for mesos container? it point to Docker? or another mesos containerizer. if my remember correctly, the mesos containerizer is native sandbox through cgroup. you can use URI to fetch files on the sandbox, it match your requirem

Re: Injecting data into mesos container

2015-11-30 Thread Adam Medziński
Yes, but it will also make that data available in mesos web UI. I need this data to be available only for task process. On 30 November 2015 at 16:20, Shuai Lin wrote: > Also mesos supports specifying a list of uris in the command info, which > you can manipulate in your framework, and mesos would

Re: Injecting data into mesos container

2015-11-30 Thread Shuai Lin
Also mesos supports specifying a list of uris in the command info, which you can manipulate in your framework, and mesos would fetch files from those uris into the task's sandbox. https://github.com/apache/mesos/blob/b2b0eed/include/mesos/mesos.proto#L391. On Mon, Nov 30, 2015 at 7:53 PM, tommy

Re: Injecting data into mesos container

2015-11-30 Thread tommy xiao
if the external volume is valid, we can use hdfs as alternative service to provide the storage solution. 2015-11-30 19:34 GMT+08:00 Vaibhav Khanduja : > One possible way could be map an external volume and make the certificate > available on the volume. The application can poll the file, and pres

Re: Mesos Flocker - Custom Isolator and Docker

2015-11-30 Thread Vaibhav Khanduja
Does this not satisfy the usecase? -> https://github.com/ClusterHQ/mesos-module-flocker On Thu, Nov 26, 2015 at 3:26 AM, Timothy Chen wrote: > Hi Tommy, > > We didn't modify MesosContainerizer container creation but only just > added image support and the ability to inherit runtime configuration

Re: Injecting data into mesos container

2015-11-30 Thread Vaibhav Khanduja
One possible way could be map an external volume and make the certificate available on the volume. The application can poll the file, and presence of file can trigger alert to read it. 2cnts On Mon, Nov 30, 2015 at 4:56 PM, tommy xiao wrote: > Haosdent's suggest is not ideal way. > > 2015-11-30

Re: Injecting data into mesos container

2015-11-30 Thread tommy xiao
Haosdent's suggest is not ideal way. 2015-11-30 0:28 GMT+08:00 Jojy Varghese : > Haosdent is right that “nsenter” is used by docker users but wanted to add > that it is not a docker only command. It is a linux utility that can be > used to enter the namespaces of processes using their “procfs” fi