Chris Douglas commented on YARN-3100:

[~aw], have you read through the patch? What it implements looks like a pretty 
straightfoward application of the common ACL libraries to queues and 
applications. It just routes some of the YARN checks to a configurable 
component. Is there functionality implemented in the common libs that's not 
being used?

A few quick questions:
* What is the behavior of {{refreshQueues}}? It looks like the provider class 
remains fixed (should it throw an exception if the class in the conf doesn't 
match the singleton?), but every queue's ACLs get reset from the config. The 
refresh isn't transactional, though... if it fails partway through, the ACLs 
could be partially refreshed in the provider. Is that correct? If the provider 
is {{Configurable}}, then it also doesn't get reconfigured, as it will return 
the singleton from the first call to {{getInstance()}}
* Could we avoid pluggable implementations with a {{Default\*}} class? A 
descriptive name is easier to change and... well, descriptive.
* {{PrivilegedEntity}} is an odd class. Would it be possible to expand on its 
definition in the javadoc, and (as a public class) add annotations for its 
intended audience (HADOOP-5073)?

> Make YARN authorization pluggable
> ---------------------------------
>                 Key: YARN-3100
>                 URL: https://issues.apache.org/jira/browse/YARN-3100
>             Project: Hadoop YARN
>          Issue Type: Bug
>            Reporter: Jian He
>            Assignee: Jian He
>         Attachments: YARN-3100.1.patch, YARN-3100.2.patch
> The goal is to have YARN acl model pluggable so as to integrate other 
> authorization tool such as Apache Ranger, Sentry.
> Currently, we have 
> - admin ACL
> - queue ACL
> - application ACL
> - time line domain ACL
> - service ACL
> The proposal is to create a YarnAuthorizationProvider interface. Current 
> implementation will be the default implementation. Ranger or Sentry plug-in 
> can implement  this interface.
> Benefit:
> -  Unify the code base. With the default implementation, we can get rid of 
> each specific ACL manager such as AdminAclManager, ApplicationACLsManager, 
> QueueAclsManager etc.
> - Enable Ranger, Sentry to do authorization for YARN. 

This message was sent by Atlassian JIRA

Reply via email to