Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

YARN-10039. Allow disabling app submission from REST endpoints 

(cherry picked from commit fddc3d55c3)
This commit is contained in:
Jonathan Hung 2019-12-18 10:48:05 -08:00
parent afe00a1ca5
commit 01e2c996ff
4 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java
View File

@ -3834,6 +3834,10 @@ public class YarnConfiguration extends Configuration {
public static final boolean DEFAULT_DISPLAY_APPS_FOR_LOGGED_IN_USER =
false;
public static final String ENABLE_REST_APP_SUBMISSIONS =
"yarn.webapp.enable-rest-app-submissions";
public static final boolean DEFAULT_ENABLE_REST_APP_SUBMISSIONS = true;
// RM and NM CSRF props
public static final String REST_CSRF = "webapp.rest-csrf.";
public static final String RM_CSRF_PREFIX = RM_PREFIX + REST_CSRF;

6
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/yarn-default.xml
View File

@ -4136,4 +4136,10 @@
<name>yarn.workflow-id.tag-prefix</name>
<value>workflowid:</value>
</property>
<property>
<description>Whether or not to allow application submissions via REST. Default is true.</description>
<name>yarn.webapp.enable-rest-app-submissions</name>
<value>true</value>
</property>
</configuration>

12
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/RMWebServices.java
View File

@ -232,6 +232,7 @@ public class RMWebServices extends WebServices implements RMWebServiceProtocol {
@VisibleForTesting
boolean isCentralizedNodeLabelConfiguration = true;
private boolean filterAppsByUser = false;
private boolean enableRestAppSubmissions = true;
public final static String DELEGATION_TOKEN_HEADER =
"Hadoop-YARN-RM-Delegation-Token";
@ -247,6 +248,9 @@ public class RMWebServices extends WebServices implements RMWebServiceProtocol {
this.filterAppsByUser = conf.getBoolean(
YarnConfiguration.FILTER_ENTITY_LIST_BY_USER,
YarnConfiguration.DEFAULT_DISPLAY_APPS_FOR_LOGGED_IN_USER);
this.enableRestAppSubmissions = conf.getBoolean(
YarnConfiguration.ENABLE_REST_APP_SUBMISSIONS,
YarnConfiguration.DEFAULT_ENABLE_REST_APP_SUBMISSIONS);
}
RMWebServices(ResourceManager rm, Configuration conf,
@ -1471,6 +1475,10 @@ public class RMWebServices extends WebServices implements RMWebServiceProtocol {
@Override
public Response createNewApplication(@Context HttpServletRequest hsr)
throws AuthorizationException, IOException, InterruptedException {
if (!enableRestAppSubmissions) {
String msg = "App submission via REST is disabled.";
return Response.status(Status.FORBIDDEN).entity(msg).build();
}
UserGroupInformation callerUGI = getCallerUserGroupInformation(hsr, true);
initForWritableEndpoints(callerUGI, false);
@ -1491,6 +1499,10 @@ public class RMWebServices extends WebServices implements RMWebServiceProtocol {
public Response submitApplication(ApplicationSubmissionContextInfo newApp,
@Context HttpServletRequest hsr)
throws AuthorizationException, IOException, InterruptedException {
if (!enableRestAppSubmissions) {
String msg = "App submission via REST is disabled.";
return Response.status(Status.FORBIDDEN).entity(msg).build();
}
UserGroupInformation callerUGI = getCallerUserGroupInformation(hsr, true);
initForWritableEndpoints(callerUGI, false);

20
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/TestRMWebServices.java
View File

@ -36,6 +36,7 @@ import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
@ -60,6 +61,7 @@ import org.apache.hadoop.yarn.server.resourcemanager.scheduler.ResourceScheduler
import org.apache.hadoop.yarn.server.resourcemanager.scheduler.capacity.CapacityScheduler;
import org.apache.hadoop.yarn.server.resourcemanager.scheduler.fair.FairScheduler;
import org.apache.hadoop.yarn.server.resourcemanager.scheduler.fifo.FifoScheduler;
import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.ApplicationSubmissionContextInfo;
import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.AppsInfo;
import org.apache.hadoop.yarn.server.resourcemanager.webapp.dao.ClusterUserInfo;
import org.apache.hadoop.yarn.server.security.ApplicationACLsManager;
@ -857,6 +859,24 @@ public class TestRMWebServices extends JerseyTestBase {
verifyClusterUserInfo(userInfo, "yarn", "admin");
}
@Test
public void testDisableRestAppSubmission() throws Exception {
Configuration conf = new YarnConfiguration();
conf.setBoolean(YarnConfiguration.ENABLE_REST_APP_SUBMISSIONS, false);
RMWebServices webSvc = new RMWebServices(mock(ResourceManager.class), conf,
mock(HttpServletResponse.class));
HttpServletRequest request = mock(HttpServletRequest.class);
Response response = webSvc.createNewApplication(request);
assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
assertEquals("App submission via REST is disabled.", response.getEntity());
response = webSvc.submitApplication(
mock(ApplicationSubmissionContextInfo.class), request);
assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
assertEquals("App submission via REST is disabled.", response.getEntity());
}
public void verifyClusterUserInfo(ClusterUserInfo userInfo,
String rmLoginUser, String requestedUser) {
assertEquals("rmLoginUser doesn't match: ",