Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mesos authentication #37

Merged
merged 1 commit into from
May 23, 2015
Merged

Mesos authentication #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,9 @@ Storm/Mesos provides resource isolation between topologies. So you don't need to
* `mesos.offer.lru.cache.size`: LRU cache size. Defaults to "1000".
* `mesos.local.file.server.port`: Port for the local file server to bind to. Defaults to a random port.
* `mesos.framework.name`: Framework name. Defaults to "Storm!!!".
* `mesos.framework.principal`: Framework principal to use to register with Mesos
* `mesos.framework.secret.file`: Location of file that contains the principal's secret. Secret cannot end with a NL.


## Resource configuration

Expand Down
151 changes: 110 additions & 41 deletions src/storm/mesos/MesosNimbus.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,12 @@
import backtype.storm.Config;
import backtype.storm.scheduler.*;
import backtype.storm.utils.LocalState;

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whitespace.

import com.google.common.base.Function;
import com.google.common.base.Optional;
import com.google.protobuf.ByteString;
import org.apache.commons.lang3.builder.ToStringBuilder;
import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;
import org.apache.mesos.MesosSchedulerDriver;
import org.apache.mesos.Protos.*;
Expand All @@ -36,6 +38,8 @@
import org.apache.mesos.SchedulerDriver;
import org.json.simple.JSONValue;

import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URISyntaxException;
Expand All @@ -58,6 +62,9 @@ public class MesosNimbus implements INimbus {
public static final String CONF_MESOS_ALLOWED_HOSTS = "mesos.allowed.hosts";
public static final String CONF_MESOS_DISALLOWED_HOSTS = "mesos.disallowed.hosts";
public static final String CONF_MESOS_ROLE = "mesos.framework.role";
public static final String CONF_MESOS_PRINCIPAL = "mesos.framework.principal";
public static final String CONF_MESOS_SECRET_FILE = "mesos.framework.secret.file";

public static final String CONF_MESOS_CHECKPOINT = "mesos.framework.checkpoint";
public static final String CONF_MESOS_OFFER_LRU_CACHE_SIZE = "mesos.offer.lru.cache.size";
public static final String CONF_MESOS_LOCAL_FILE_SERVER_PORT = "mesos.local.file.server.port";
Expand Down Expand Up @@ -105,54 +112,65 @@ public String getHostName(Map<String, SupervisorDetails> map, String nodeId) {
@Override
public void prepare(Map conf, String localDir) {
try {
_conf = conf;
initialize(conf,localDir);

MesosSchedulerDriver driver = createMesosDriver();

driver.start();

LOG.info("Waiting for scheduler driver to register MesosNimbus with mesos-master and complete initialization...");

_scheduler.waitUntilRegistered();

LOG.info("Scheduler registration and initialization complete...");

} catch (Exception e) {
LOG.error("Failed to prepare scheduler ", e);
throw new RuntimeException(e);
}
}
@SuppressWarnings("unchecked")
protected void initialize(Map conf, String localDir) throws Exception {
_conf = conf;
_state = new LocalState(localDir);
String id = (String) _state.get(FRAMEWORK_ID);

_allowedHosts = listIntoSet((List) _conf.get(CONF_MESOS_ALLOWED_HOSTS));
_disallowedHosts = listIntoSet((List) _conf.get(CONF_MESOS_DISALLOWED_HOSTS));

_allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if listIntoSet can be replaced with google's gauve Sets.newHashSet?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In src/storm/mesos/MesosNimbus.java
#37 (comment):

 } catch (Exception e) {
   throw new RuntimeException(e);
 }

}

  • @SuppressWarnings("unchecked")
  • protected void initialize(Map conf, String localDir) throws Exception {
  •  setConfig(conf);

  •  setLocalState(new LocalState(localDir));

  •  _allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));

I wonder if listIntoSet can be replaced with google's gauve
Sets.newHashSet?

No, Sets.newHashSet throws a NullPointerException if the list is null.

Thanks

On Fri, May 1, 2015 at 5:28 PM, Timothy Chen notifications@github.com
wrote:

In src/storm/mesos/MesosNimbus.java
#37 (comment):

 } catch (Exception e) {
   throw new RuntimeException(e);
 }

}

  • @SuppressWarnings("unchecked")
  • protected void initialize(Map conf, String localDir) throws Exception {
  •  setConfig(conf);

  •  setLocalState(new LocalState(localDir));

  •  _allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));

I wonder if listIntoSet can be replaced with google's gauve
Sets.newHashSet?

—
Reply to this email directly or view it on GitHub
https://github.com/mesos/storm/pull/37/files#r29535084.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if listIntoSet can be replaced with google's gauve
Sets.newHashSet?

Here is a place where I would use a setter/getter. If you use

setAllowedHost (List list) {
if (list == null)
_allowedHost = new HashSet(0);
else
_allowedHost = new HashSet(list);
}

then in (Assume the same for disallowedHost)

public boolean isHostAccepted(String hostname) {
return
(_allowedHosts == null && _disallowedHosts == null) ||
(_allowedHosts != null && _allowedHosts.contains(hostname)) ||
(_disallowedHosts != null && !_disallowedHosts.contains(hostname));
}

it would be

public boolean isHostAccepted(String hostname) {
return (getAllowedHost().contains(hostname) || !getDisallowedHost().contains(hostname);
}

The contract would hold up as long as the getters/setters were used.

Thoughts?

On Tue, May 5, 2015 at 11:59 AM, Paul Read pdread101@gmail.com wrote:

In src/storm/mesos/MesosNimbus.java
#37 (comment):

 } catch (Exception e) {
   throw new RuntimeException(e);
 }

}

  • @SuppressWarnings("unchecked")
  • protected void initialize(Map conf, String localDir) throws Exception {
  •  setConfig(conf);

  •  setLocalState(new LocalState(localDir));

  •  _allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));

I wonder if listIntoSet can be replaced with google's gauve
Sets.newHashSet?

No, Sets.newHashSet throws a NullPointerException if the list is null.

Thanks

On Fri, May 1, 2015 at 5:28 PM, Timothy Chen notifications@github.com
wrote:

In src/storm/mesos/MesosNimbus.java
#37 (comment):

 } catch (Exception e) {
   throw new RuntimeException(e);
 }

}

  • @SuppressWarnings("unchecked")
  • protected void initialize(Map conf, String localDir) throws Exception {
  •  setConfig(conf);

  •  setLocalState(new LocalState(localDir));

  •  _allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));

I wonder if listIntoSet can be replaced with google's gauve
Sets.newHashSet?

—
Reply to this email directly or view it on GitHub
https://github.com/mesos/storm/pull/37/files#r29535084.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you annotate your comments with markdown? https://help.github.com/articles/github-flavored-markdown/

i.e., put ``` above and below your code blocks. And don't wrap them unnecessarily (I'm like the protagonist from "the princess and the pea" -- I cannot read code that is malformed).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Certainly...I'm a little new to this git stuff...still feeling my way.

Interesting, markdown does not seem to take effect using the inline editor.

Thanks.

On Tue, May 5, 2015 at 12:51 PM, Erik Weathers notifications@github.com
wrote:

In src/storm/mesos/MesosNimbus.java
#37 (comment):

 } catch (Exception e) {
   throw new RuntimeException(e);
 }

}

  • @SuppressWarnings("unchecked")
  • protected void initialize(Map conf, String localDir) throws Exception {
  •  setConfig(conf);

  •  setLocalState(new LocalState(localDir));

  •  _allowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_ALLOWED_HOSTS));

Can you annotate your comments with markdown?
https://help.github.com/articles/github-flavored-markdown/

i.e., put ``` above and below your code blocks. And don't wrap them
unnecessarily (I'm like the protagonist from "the princess and the pea" --
I cannot read code that is malformed).

—
Reply to this email directly or view it on GitHub
https://github.com/mesos/storm/pull/37/files#r29688300.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No worries. Note that you can edit your existing "line notes" by clicking the pencil icon above them.

_disallowedHosts = listIntoSet((List<String>)conf.get(CONF_MESOS_DISALLOWED_HOSTS));
_scheduler = new NimbusScheduler();
createLocalServerPort();
setupHttpServer();
}

protected void createLocalServerPort() {
Integer port = (Integer) _conf.get(CONF_MESOS_LOCAL_FILE_SERVER_PORT);
LOG.debug("LocalFileServer configured to listen on port: " + port);
_localFileServerPort = Optional.fromNullable(port);
}

Number failoverTimeout = Optional.fromNullable((Number) conf.get(CONF_MASTER_FAILOVER_TIMEOUT_SECS)).or(3600);
String role = Optional.fromNullable((String) conf.get(CONF_MESOS_ROLE)).or("*");
Boolean checkpoint = Optional.fromNullable((Boolean) conf.get(CONF_MESOS_CHECKPOINT)).or(false);
String framework_name = Optional.fromNullable((String) conf.get(CONF_MESOS_FRAMEWORK_NAME)).or("Storm!!!");

FrameworkInfo.Builder finfo = FrameworkInfo.newBuilder()
.setName(framework_name)
.setFailoverTimeout(failoverTimeout.doubleValue())
.setUser("")
.setRole(role)
.setCheckpoint(checkpoint);

if (id != null) {
finfo.setId(FrameworkID.newBuilder().setValue(id).build());
}

Integer port = (Integer) _conf.get(CONF_MESOS_LOCAL_FILE_SERVER_PORT);
_localFileServerPort = Optional.fromNullable(port);
LOG.debug("LocalFileServer configured to listen on port: " + port);

protected void setupHttpServer() throws Exception {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the refactoring in general, but could you please keep refactoring commits separate from the commit that addresses the bug/issue/task?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To me they were one and the same but yes I will do that and keep the
refactoring to a minimum.

Thanks.

On Mon, May 4, 2015 at 9:56 PM, Erik Weathers notifications@github.com
wrote:

In src/storm/mesos/MesosNimbus.java
#37 (comment):

  • LOG.info("Using local port: " + port);
  • setLocalServerPort(Optional.fromNullable(port));
  • }
  • protected void setLocalServerPort(Optional port) {
  •  _localFileServerPort = port;
  • }
  • protected Optional getLocalServerPort(){
  •  return _localFileServerPort;
  • }
  • protected void setScheduler(NimbusScheduler scheduler) {
  •  _scheduler = scheduler;
  • }
  • protected NimbusScheduler getScheduler() {
  •  return _scheduler;
  • }
  • protected void setupHttpServer() throws Exception {

I like the refactoring in general, but could you please keep refactoring
commits separate from the commit that addresses the bug/issue/task?

—
Reply to this email directly or view it on GitHub
https://github.com/mesos/storm/pull/37/files#r29639976.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pdread100 I think your refactoring is reasonable, but then it makes this commit a lot harder to merge now since there are a lot of changes and also some changes are related to a new feature and mostly are just refactoring.

_httpServer = new LocalFileServer();
_configUrl = _httpServer.serveDir("/conf", "conf", _localFileServerPort);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whitespace.

LOG.info("Started HTTP server from which config for the MesosSupervisor's may be fetched. URL: " + _configUrl);

MesosSchedulerDriver driver =
new MesosSchedulerDriver(
_scheduler,
finfo.build(),
(String) conf.get(CONF_MASTER_URL));

driver.start();
LOG.info("Waiting for scheduler driver to register MesosNimbus with mesos-master and complete initialization...");
_scheduler.waitUntilRegistered();
LOG.info("Scheduler registration and initialization complete...");
} catch (Exception e) {
throw new RuntimeException(e);
}
}

protected MesosSchedulerDriver createMesosDriver() throws IOException {
MesosSchedulerDriver driver;
Credential credential;
FrameworkInfo.Builder finfo = createFrameworkBuilder();

if ((credential = getCredential(finfo)) != null) {
driver = new MesosSchedulerDriver(_scheduler,
finfo.build(),
(String)_conf.get(CONF_MASTER_URL),
credential);
} else {
driver = new MesosSchedulerDriver(_scheduler,
finfo.build(),
(String)_conf.get(CONF_MASTER_URL));
}

return driver;
}
private OfferResources getResources(Offer offer, double executorCpu, double executorMem, double cpu, double mem) {
OfferResources resources = new OfferResources();

Expand Down Expand Up @@ -745,7 +763,58 @@ public void executorLost(SchedulerDriver driver, ExecutorID executor, SlaveID sl
" slave: " + slave.getValue() + " status: " + status);
}
}

private FrameworkInfo.Builder createFrameworkBuilder() throws IOException {

String id = (String)_state.get(FRAMEWORK_ID);
Number failoverTimeout = Optional.fromNullable((Number)_conf.get(CONF_MASTER_FAILOVER_TIMEOUT_SECS)).or(3600);
String role = Optional.fromNullable((String)_conf.get(CONF_MESOS_ROLE)).or("*");
Boolean checkpoint = Optional.fromNullable((Boolean)_conf.get(CONF_MESOS_CHECKPOINT)).or(false);
String framework_name = Optional.fromNullable((String)_conf.get(CONF_MESOS_FRAMEWORK_NAME)).or("Storm!!!");

FrameworkInfo.Builder finfo = FrameworkInfo.newBuilder()
.setName(framework_name)
.setFailoverTimeout(failoverTimeout.doubleValue())
.setUser("")
.setRole(role)
.setCheckpoint(checkpoint);

if (id != null) {
finfo.setId(FrameworkID.newBuilder().setValue(id).build());
}

return finfo;
}

private Credential getCredential(FrameworkInfo.Builder finfo) {
LOG.info("Checking for mesos authentication");

Credential credential = null;

String principal = Optional.fromNullable((String)_conf.get(CONF_MESOS_PRINCIPAL)).orNull();
String secretFilename = Optional.fromNullable((String)_conf.get(CONF_MESOS_SECRET_FILE)).orNull();;

if (principal != null) {
finfo.setPrincipal(principal);
Credential.Builder credentialBuilder = Credential.newBuilder();
credentialBuilder.setPrincipal(principal);
if (StringUtils.isNotEmpty(secretFilename)) {
try {
// The secret cannot have a NewLine after it
credentialBuilder.setSecret(ByteString.readFrom(new FileInputStream(secretFilename)));
} catch (FileNotFoundException ex) {
LOG.error("Mesos authentication secret file was not found", ex);
throw new RuntimeException(ex);
} catch (IOException ex) {
LOG.error("Error reading Mesos authentication secret file", ex);
throw new RuntimeException(ex);
}
}
credential = credentialBuilder.build();
}
return credential;
}


private class LaunchTask {
public final TaskInfo task;
public final Offer offer;
Expand Down
11 changes: 11 additions & 0 deletions storm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,21 @@ storm.messaging.transport: "backtype.storm.messaging.netty.Context"

storm.local.dir: "storm-local"

# role must be one of the mesos-master's roles defined in the --roles flag
#
mesos.framework.role: "*"
mesos.framework.checkpoint: false
mesos.framework.name: "Storm"

# For setting up the necessary mesos authentication see mesos authentication page
# and set the mesos-master flags --credentials, --authenticate, --acls, and --roles.
#
#mesos.framework.principal: "storm"

# The "secret" phrase cannot be followed by a NL
#
#mesos.framework.secret.file: "storm-local/secret"

#mesos.allowed.hosts:
# - host1
#mesos.disallowed.hosts:
Expand Down