mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alexander Rojas <alexan...@mesosphere.io>
Subject Re: Review Request 59101: Enabled authorization for v1 API call GET_MAINTENANCE_STATUS.
Date Fri, 02 Jun 2017 07:48:37 GMT


> On June 2, 2017, 4:16 a.m., Greg Mann wrote:
> > src/master/http.cpp
> > Lines 4778 (patched)
> > <https://reviews.apache.org/r/59101/diff/4/?file=1731542#file1731542line4778>
> >
> >     In the agent's HTTP handlers, when `ObjectApprover::approved` returns an error,
the handler returns a `Failure`.
> >     
> >     With this code as-is, if the authorizer is in a bad state and all `approved`
calls return errors, the client would get a successful response with an empty body. Is that
the behavior we want?
> >     
> >     I would expect that in the case where all `approved` calls return errors, the
handler would return a `Failure`. I'm not sure about the case where only some `approved` calls
return errors.
> >     
> >     Looking at the handler for '/containers' on the agent, we simply log a warning
if authorization for one of the containers returns an error, so I think that endpoint may
return a successful result when all `approved` calls return errors.
> >     
> >     I think at the very least, we should log a warning when `approved` returns an
error, and we should consider if there's a good way to return an unsuccessful response to
the client when all authorizations fail.

I'm in for returning a warning, however all the filtering endpoints assume `false` in the
case of error. Examples: [`approveViewExecutorInfo`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L830),
[`approveViewFrameworkInfo`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L812),
[`approveViewTaskInfo`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L850),
[`approveViewTask`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L869),
[`approveViewFlags`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L888),
[`approveViewRole`](https://github.com/apache/mesos/blob/master/src/common/http.cpp#L945)


- Alexander


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/59101/#review176722
-----------------------------------------------------------


On June 1, 2017, 4:57 p.m., Alexander Rojas wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/59101/
> -----------------------------------------------------------
> 
> (Updated June 1, 2017, 4:57 p.m.)
> 
> 
> Review request for mesos, Adam B, Greg Mann, and Till Toenshoff.
> 
> 
> Bugs: MESOS-7415
>     https://issues.apache.org/jira/browse/MESOS-7415
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> Enables the use of authorization for the `GET_MAINTENANCE_STATUS`
> v1 API call, using the ACL `GetMaintenanceStatus` and the action
> of the same name as the API call.
> 
> It also updates the ApiTests to take into account the authorization
> case.
> 
> 
> Diffs
> -----
> 
>   src/master/http.cpp 7060b8fa53e0682681c50e051908ffbbf50fb7da 
>   src/master/master.hpp 89d0790fd5fea59e74276f462581fe0073594732 
>   src/tests/api_tests.cpp faf3242f9c86d866c4bb5e457fcfe47c1063cc09 
> 
> 
> Diff: https://reviews.apache.org/r/59101/diff/4/
> 
> 
> Testing
> -------
> 
> make check
> 
> 
> Thanks,
> 
> Alexander Rojas
> 
>


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message