Jian He commented on YARN-3100:

Chris, thanks for your comments !
bq. What is the behavior of refreshQueues?
Good question. Basically, we now have two sources of truth for the ACL info. 
One is the queue config file, the other is the external component(the external 
component has their own acl storage and can change the acl from their own web 
UI etc.). I think a good practice is to only allow one single source of truth. 
We only allow one authorizer implementation, we don't support a mix.  If the 
external component is used for authorization, the refreshQueue command will not 
update the ACL info into the external component, it's a no-op.  The ACL defined 
in queue configs is only used to bootstrap the external component to feed in 
the initial ACL info and then the external component takes care of the rest. 
Please share your thoughts. thx  

bq. Could we avoid pluggable implementations with a Default* class? 
PrivilegedEntity is an odd class. Would it be possible to expand on its 
definition in the javadoc,
sure, will do

> Make YARN authorization pluggable
> ---------------------------------
>                 Key: YARN-3100
>                 URL: https://issues.apache.org/jira/browse/YARN-3100
>             Project: Hadoop YARN
>          Issue Type: Bug
>            Reporter: Jian He
>            Assignee: Jian He
>         Attachments: YARN-3100.1.patch, YARN-3100.2.patch
> The goal is to have YARN acl model pluggable so as to integrate other 
> authorization tool such as Apache Ranger, Sentry.
> Currently, we have 
> - admin ACL
> - queue ACL
> - application ACL
> - time line domain ACL
> - service ACL
> The proposal is to create a YarnAuthorizationProvider interface. Current 
> implementation will be the default implementation. Ranger or Sentry plug-in 
> can implement  this interface.
> Benefit:
> -  Unify the code base. With the default implementation, we can get rid of 
> each specific ACL manager such as AdminAclManager, ApplicationACLsManager, 
> QueueAclsManager etc.
> - Enable Ranger, Sentry to do authorization for YARN. 

This message was sent by Atlassian JIRA

Reply via email to