spark-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From andrewor14 <...@git.apache.org>
Subject [GitHub] spark pull request: Spark 1489 Fix the HistoryServer view acls
Date Wed, 23 Apr 2014 21:49:00 GMT
Github user andrewor14 commented on a diff in the pull request:

    https://github.com/apache/spark/pull/509#discussion_r11925679
  
    --- Diff: core/src/main/scala/org/apache/spark/deploy/history/HistoryServer.scala ---
    @@ -167,17 +167,23 @@ class HistoryServer(
        * directory. If this file exists, the associated application is regarded to be completed,
in
        * which case the server proceeds to render the SparkUI. Otherwise, the server does
nothing.
        */
    -  private def renderSparkUI(logDir: FileStatus, logInfo: EventLoggingInfo) {
    +  private def renderSparkUI(logDir: FileStatus, elogInfo: EventLoggingInfo) {
         val path = logDir.getPath
         val appId = path.getName
    -    val replayBus = new ReplayListenerBus(logInfo.logPaths, fileSystem, logInfo.compressionCodec)
    +    val replayBus = new ReplayListenerBus(elogInfo.logPaths, fileSystem, elogInfo.compressionCodec)
         val appListener = new ApplicationEventListener
         replayBus.addListener(appListener)
    -    val ui = new SparkUI(conf, replayBus, appId, "/history/" + appId)
    +    val appConf = conf.clone()
    +    val appSecManager = new SecurityManager(appConf)
    +    val ui = new SparkUI(conf, appSecManager, replayBus, appId, "/history/" + appId)
     
         // Do not call ui.bind() to avoid creating a new server for each application
         replayBus.replay()
         if (appListener.applicationStarted) {
    +      // Note this relies on the user setting acls properly. We could also add in a master
config
    +      // to the history server that admins would set if we don't trust the user.
    +      appSecManager.setViewAcls(appListener.sparkUser, appListener.viewAcls)
    +      appSecManager.setUIAcls(appListener.enableViewAcls)
    --- End diff --
    
    One use case of overriding is that the logs could have imposed ACLs for users that no
longer exists (e.g. the application ran on an old cluster). In this case the ACLs are essentially
outdated and it would be good if there exists a way to read the logs.
    
    I see, is this what you're suggesting?
    (1) HistoryServer sets `spark.ui.acls.enable=true` - override all application security
configs
    (2) HistoryServer does not set `spark.ui.acls.enable` - just honor the application's preferences.
    (3) HistoryServer sets `spark.ui.acls.enable=false` - override and disable ACLs for all
applications.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message