org.apache.tez.common.security

Interface HistoryACLPolicyManager

All Superinterfaces:

org.apache.hadoop.conf.Configurable

@InterfaceStability.Unstable
 @InterfaceAudience.Private
public interface HistoryACLPolicyManager
extends org.apache.hadoop.conf.Configurable

ACL Policy Manager An instance of this implements any ACL related activity when starting a session or submitting a DAG. It is used in the HistoryLoggingService to create domain ids and populate entities with domain id.

Method Summary

Modifier and Type	Method and Description
void	close() Call this to stop and clean up
Map<String,String>	setupNonSessionACLs(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.yarn.api.records.ApplicationId applicationId, DAGAccessControls dagAccessControls) Not used currently.
Map<String,String>	setupSessionACLs(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.yarn.api.records.ApplicationId applicationId) Take any necessary steps for setting up both Session ACLs and non session acls.
Map<String,String>	setupSessionDAGACLs(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.yarn.api.records.ApplicationId applicationId, String dagName, DAGAccessControls dagAccessControls) Take any necessary steps for setting up ACLs for a DAG that is submitted to a Session.
void	updateTimelineEntityDomain(Object timelineEntity, String domainId) Called with a timeline entity which has to be updated with a domain id.

Methods inherited from interface org.apache.hadoop.conf.Configurable

getConf, setConf

Method Detail

setupSessionACLs

Map<String,String> setupSessionACLs(org.apache.hadoop.conf.Configuration conf,
                                    org.apache.hadoop.yarn.api.records.ApplicationId applicationId)
                             throws IOException,
                                    HistoryACLPolicyException

Take any necessary steps for setting up both Session ACLs and non session acls. This is called with the am configuration which contains the ACL information to be used to create a domain. If the method returns a value, then its assumed to be a valid domain and used as domainId. If the method returns null, acls are disabled at session level, i.e use default acls at session level. If the method throws an Exception, history logging is disabled for the entire session.

Parameters:

conf - Configuration

applicationId - Application ID for the session

Throws:

Exception

IOException

HistoryACLPolicyException

setupNonSessionACLs

Map<String,String> setupNonSessionACLs(org.apache.hadoop.conf.Configuration conf,
                                       org.apache.hadoop.yarn.api.records.ApplicationId applicationId,
                                       DAGAccessControls dagAccessControls)
                                throws IOException,
                                       HistoryACLPolicyException

Not used currently.

Parameters:

conf - Configuration

applicationId - Application ID for the AM

dagAccessControls - ACLs defined for the DAG being submitted

Throws:

Exception

IOException

HistoryACLPolicyException

setupSessionDAGACLs

Map<String,String> setupSessionDAGACLs(org.apache.hadoop.conf.Configuration conf,
                                       org.apache.hadoop.yarn.api.records.ApplicationId applicationId,
                                       String dagName,
                                       DAGAccessControls dagAccessControls)
                                throws IOException,
                                       HistoryACLPolicyException

Take any necessary steps for setting up ACLs for a DAG that is submitted to a Session. This is called with dag configuration. If the method returns a value, then it is assumed to be valid domain and is used as a domainId for all of the dag events. If the method returns null, it falls back to session level acls. If the method throws Exception: it disables history logging for the dag events.

Parameters:

conf - Configuration

applicationId - Application ID for the AM

dagAccessControls - ACLs defined for the DAG being submitted

Throws:

Exception

IOException

HistoryACLPolicyException

updateTimelineEntityDomain

void updateTimelineEntityDomain(Object timelineEntity,
                                String domainId)

Called with a timeline entity which has to be updated with a domain id.

Parameters:

timelineEntity - The timeline entity which will be published.

domainId - The domainId returned by one of the setup*ACL calls.

close

void close()

Call this to stop and clean up