mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Adam B <a...@mesosphere.io>
Subject Re: Review Request 49313: Added the VIEW_FLAGS authorization action.
Date Wed, 29 Jun 2016 08:00:15 GMT


> On June 28, 2016, 10:17 p.m., Jie Yu wrote:
> > src/master/http.cpp, lines 2080-2082
> > <https://reviews.apache.org/r/49313/diff/1/?file=1431790#file1431790line2080>
> >
> >     This looks like a flag too? If you do not want to treat that as a flag, add
a note at least?

Yeah, we can document it. I think the cluster name should be generic enough metadata that
we can leave it open to any (authenticated) user. Other endpoints like /version didn't seem
worth protecting either. We're not even trying to protect access to cluster resource information,
let alone cluster name.


- Adam


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/49313/#review139931
-----------------------------------------------------------


On June 28, 2016, 3:51 p.m., Alexander Rojas wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/49313/
> -----------------------------------------------------------
> 
> (Updated June 28, 2016, 3:51 p.m.)
> 
> 
> Review request for mesos, Adam B, Joerg Schad, Till Toenshoff, and Vinod Kone.
> 
> 
> Bugs: MESOS-5705
>     https://issues.apache.org/jira/browse/MESOS-5705
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> Adds again authorization for flags. Instead of being part of
> `get_endpoints` it uses its own action `VIEW_FLAGS` which is
> used to restrict access to the `/flags` endpoint, as well as
> to filter the results of the `/state` endpoint on both master
> and agents.
> 
> 
> Diffs
> -----
> 
>   include/mesos/authorizer/acls.proto a6d93cd2cb9161a98565b22e50b06aac4931a671 
>   include/mesos/authorizer/authorizer.proto fc76796022a6fa3d36a1447c476980868d42c2d0

>   src/authorizer/local/authorizer.cpp 3fade4168face1cb80b30c9b69b31d9eb4126222 
>   src/common/http.hpp 55bd0ac81af80c656a4a80766a3e4b21db9cf0cf 
>   src/common/http.cpp 95e8fb672b49a00860c64f818cc734fa22cf3516 
>   src/master/http.cpp e089fe960779f39b3321f2ec81ab2acc17d53641 
>   src/slave/http.cpp 44d8cc98c0c1ada9d5313a3fe5c66029c9c373c6 
>   src/tests/authorization_tests.cpp 9b99da138fa27a725738d70bd99e889b108b44ae 
>   src/tests/master_authorization_tests.cpp 81804e0522fd6b26155732af08e33c4d0bb0a8fe 
>   src/tests/slave_authorization_tests.cpp 78221e200d9b7880cc474f1acef92c5dec1c8e25 
> 
> Diff: https://reviews.apache.org/r/49313/diff/
> 
> 
> Testing
> -------
> 
> - `make check`
> - manual tests with browsers.
> - Used the script:
>  
> ```sh
> #! /usr/bin/env bash
> 
> rm -rf /tmp/mesos/*
> 
> cat <<EOF > /tmp/credentials.txt
> foo bar
> baz bar
> EOF
> 
> cat <<EOF > /tmp/acls.json
> {
>   "permissive": false,
>   "view_flags" : [
>    {
>      "principals" : { "values" : ["foo"] },
>      "flags" : { "type" : "ANY" }
>    },
>    {
>      "principals" : { "values" : ["foo"] },
>      "flags" : { "type" : "NONE" }
>    }
>   ]
> }
> EOF
> 
> ./bin/mesos-master.sh --work_dir=/tmp/mesos/master \
>                      --authenticate_http \
>                      --log_dir=/tmp/mesos/logs/master \
>                      --http_credentials=file:///tmp/credentials.txt \
>                      --acls=file:///tmp/acls.json &
> ./bin/mesos-slave.sh --work_dir=/tmp/mesos/slave \
>                      --master=127.0.0.1:5050 \
>                      --authenticate_http \
>                      --http_credentials=file:///tmp/credentials.txt \
>                      --acls=file:///tmp/acls.json &
> 
> # Returns a 200 OK Response with the contents of the flags
> # in JSON object
> http GET http://127.0.0.1:5050/flags -a foo:bar
> http GET http://127.0.0.1:5051/flags -a foo:bar
> 
> # Returned JSON contains a `flags` entry with all the flags.
> http GET http://127.0.0.1:5050/state -a foo:bar
> http GET http://127.0.0.1:5051/state -a foo:bar
> 
> # 403 Forbidden response
> http GET http://127.0.0.1:5050/flags -a baz:bar
> http GET http://127.0.0.1:5051/flags -a baz:bar
> 
> # Returned JSON doesn't include flags information.
> http GET http://127.0.0.1:5050/state -a baz:bar
> http GET http://127.0.0.1:5051/state -a baz:bar
> ```
> 
> 
> Thanks,
> 
> Alexander Rojas
> 
>


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message