You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by qi...@apache.org on 2018/11/08 09:42:02 UTC
[mesos] branch 1.6.x updated (e675f53 -> a3cb327)
This is an automated email from the ASF dual-hosted git repository.
qianzhang pushed a change to branch 1.6.x
in repository https://gitbox.apache.org/repos/asf/mesos.git.
from e675f53 Added MESOS-9152 and MESOS-9164 to the 1.6.2 CHANGELOG.
new 4aad719 Made nested container runs as its parent container's user by default.
new 57fa16e Added a test `ROOT_UNPRIVILEGED_USER_DefaultExecutorCommandHealthCheck`.
new 8ab3874 Fixed a coding error that a test waited on a wrong task status update.
new a3cb327 Added MESOS-9332 to the 1.6.2 CHANGELOG.
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
CHANGELOG | 1 +
src/slave/containerizer/mesos/containerizer.cpp | 10 ++
src/slave/http.cpp | 16 +--
src/tests/health_check_tests.cpp | 143 +++++++++++++++++++++++-
4 files changed, 155 insertions(+), 15 deletions(-)
[mesos] 03/04: Fixed a coding error that a test waited on a wrong
task status update.
Posted by qi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
qianzhang pushed a commit to branch 1.6.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 8ab38747fd6fbbf95a767cef917e8a54609ecc26
Author: Qian Zhang <zh...@gmail.com>
AuthorDate: Thu Nov 1 13:35:49 2018 -0700
Fixed a coding error that a test waited on a wrong task status update.
Review: https://reviews.apache.org/r/69236
---
src/tests/health_check_tests.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/tests/health_check_tests.cpp b/src/tests/health_check_tests.cpp
index 7f295bd..006f289 100644
--- a/src/tests/health_check_tests.cpp
+++ b/src/tests/health_check_tests.cpp
@@ -1736,7 +1736,7 @@ TEST_F_TEMP_DISABLED_ON_WINDOWS(
driver.acceptOffers(
{offers->front().id()}, {LAUNCH_GROUP(executor, taskGroup)});
- AWAIT_READY(statusRunning);
+ AWAIT_READY(statusStarting);
EXPECT_EQ(TASK_STARTING, statusStarting->state());
AWAIT_READY(statusRunning);
[mesos] 02/04: Added a test
`ROOT_UNPRIVILEGED_USER_DefaultExecutorCommandHealthCheck`.
Posted by qi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
qianzhang pushed a commit to branch 1.6.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 57fa16e6e4b007e22489b7c0b2e1de3ff4c5d8ea
Author: Qian Zhang <zh...@gmail.com>
AuthorDate: Wed Oct 31 17:18:18 2018 -0700
Added a test `ROOT_UNPRIVILEGED_USER_DefaultExecutorCommandHealthCheck`.
Review: https://reviews.apache.org/r/69235
---
src/tests/health_check_tests.cpp | 141 +++++++++++++++++++++++++++++++++++++++
1 file changed, 141 insertions(+)
diff --git a/src/tests/health_check_tests.cpp b/src/tests/health_check_tests.cpp
index 9fa04af..7f295bd 100644
--- a/src/tests/health_check_tests.cpp
+++ b/src/tests/health_check_tests.cpp
@@ -1900,6 +1900,147 @@ TEST_F_TEMP_DISABLED_ON_WINDOWS(
}
+// This test verifies that the debug container launched by the command health
+// check will be run as the user of its parent container rather than the user
+// of the default executor. This is a regression test for MESOS-9332.
+TEST_F_TEMP_DISABLED_ON_WINDOWS(
+ HealthCheckTest, ROOT_UNPRIVILEGED_USER_DefaultExecutorCommandHealthCheck)
+{
+ Try<Owned<cluster::Master>> master = StartMaster();
+ ASSERT_SOME(master);
+
+ slave::Flags flags = CreateSlaveFlags();
+
+#ifndef USE_SSL_SOCKET
+ // Set permissive ACLs in the agent so that the local authorizer will be
+ // loaded and implicit executor authorization will be tested.
+ ACLs acls;
+ acls.set_permissive(true);
+
+ flags.acls = acls;
+#endif // USE_SSL_SOCKET
+
+ Fetcher fetcher(flags);
+
+ // We have to explicitly create a `Containerizer` in non-local mode,
+ // because `LaunchNestedContainerSession` (used by command health
+ // checks) tries to start a IO switchboard, which doesn't work in
+ // local mode yet.
+ Try<MesosContainerizer*> _containerizer =
+ MesosContainerizer::create(flags, false, &fetcher);
+
+ ASSERT_SOME(_containerizer);
+
+ Owned<slave::Containerizer> containerizer(_containerizer.get());
+ Owned<MasterDetector> detector = master.get()->createDetector();
+
+ Try<Owned<cluster::Slave>> agent =
+ StartSlave(detector.get(), containerizer.get(), flags);
+
+ ASSERT_SOME(agent);
+
+ Option<string> user = os::getenv("SUDO_USER");
+ ASSERT_SOME(user);
+
+ // Set the framework user to a non-root user so the default executor will
+ // also be run as this non-root user since the default executor always runs
+ // as the same user of the framework.
+ FrameworkInfo frameworkInfo = DEFAULT_FRAMEWORK_INFO;
+ frameworkInfo.set_user(user.get());
+
+ MockScheduler sched;
+ MesosSchedulerDriver driver(
+ &sched, frameworkInfo, master.get()->pid, DEFAULT_CREDENTIAL);
+
+ Future<FrameworkID> frameworkId;
+ EXPECT_CALL(sched, registered(&driver, _, _))
+ .WillOnce(FutureArg<1>(&frameworkId));
+
+ Future<vector<Offer>> offers;
+ EXPECT_CALL(sched, resourceOffers(&driver, _))
+ .WillOnce(FutureArg<1>(&offers))
+ .WillRepeatedly(Return()); // Ignore subsequent offers.
+
+ driver.start();
+
+ AWAIT_READY(frameworkId);
+
+ AWAIT_READY(offers);
+ ASSERT_FALSE(offers->empty());
+
+ Future<TaskStatus> statusStarting;
+ Future<TaskStatus> statusRunning;
+ Future<TaskStatus> statusHealthy;
+
+ EXPECT_CALL(sched, statusUpdate(&driver, _))
+ .WillOnce(FutureArg<1>(&statusStarting))
+ .WillOnce(FutureArg<1>(&statusRunning))
+ .WillOnce(FutureArg<1>(&statusHealthy));
+
+ // Launch a task as root user to create a file.
+ TaskInfo task = createTask(offers->front(), "touch file && sleep 120");
+ task.mutable_command()->set_user("root");
+
+ // Run the command health check without specifying user in its `CommandInfo`,
+ // and the health check will try to write to the file created by the task.
+ // Since the debug container launched by the health check will run as the same
+ // user (i.e., root user) of its parent container (i.e., the task), it will
+ // have the permission to write to the file.
+ HealthCheck healthCheck;
+ healthCheck.set_type(HealthCheck::COMMAND);
+ healthCheck.mutable_command()->set_value("echo abc > file");
+ healthCheck.set_delay_seconds(0);
+ healthCheck.set_interval_seconds(0);
+ healthCheck.set_grace_period_seconds(0);
+
+ task.mutable_health_check()->CopyFrom(healthCheck);
+
+ Resources executorResources =
+ allocatedResources(Resources::parse("cpus:0.1;mem:32;disk:32").get(), "*");
+
+ task.mutable_resources()->CopyFrom(task.resources() - executorResources);
+
+ TaskGroupInfo taskGroup;
+ taskGroup.add_tasks()->CopyFrom(task);
+
+ ExecutorInfo executor;
+ executor.mutable_executor_id()->set_value("default");
+ executor.set_type(ExecutorInfo::DEFAULT);
+ executor.mutable_framework_id()->CopyFrom(frameworkId.get());
+ executor.mutable_resources()->CopyFrom(executorResources);
+ executor.mutable_shutdown_grace_period()->set_nanoseconds(Seconds(10).ns());
+
+ driver.acceptOffers(
+ {offers->front().id()}, {LAUNCH_GROUP(executor, taskGroup)});
+
+ AWAIT_READY(statusStarting);
+ EXPECT_EQ(TASK_STARTING, statusStarting->state());
+
+ AWAIT_READY(statusRunning);
+ EXPECT_EQ(TASK_RUNNING, statusRunning->state());
+
+ AWAIT_READY(statusHealthy);
+ EXPECT_EQ(TASK_RUNNING, statusHealthy->state());
+ EXPECT_EQ(
+ TaskStatus::REASON_TASK_HEALTH_CHECK_STATUS_UPDATED,
+ statusHealthy->reason());
+ EXPECT_TRUE(statusHealthy->has_healthy());
+ EXPECT_TRUE(statusHealthy->healthy());
+
+ Future<hashset<ContainerID>> containerIds = containerizer->containers();
+
+ AWAIT_READY(containerIds);
+
+ driver.stop();
+ driver.join();
+
+ // Cleanup all mesos launched containers.
+ foreach (const ContainerID& containerId, containerIds.get()) {
+ AWAIT_READY(containerizer->wait(containerId));
+ }
+}
+
+
// Fixture for testing TCP/HTTP(S) health check support
// for Docker containers on Docker user network.
class DockerContainerizerHealthCheckTest
[mesos] 01/04: Made nested container runs as its parent container's
user by default.
Posted by qi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
qianzhang pushed a commit to branch 1.6.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 4aad719121c6f0910d8b6a2059d9c17048957ea2
Author: Qian Zhang <zh...@gmail.com>
AuthorDate: Fri Oct 26 09:23:27 2018 +0800
Made nested container runs as its parent container's user by default.
Review: https://reviews.apache.org/r/69234
---
src/slave/containerizer/mesos/containerizer.cpp | 10 ++++++++++
src/slave/http.cpp | 16 ++--------------
2 files changed, 12 insertions(+), 14 deletions(-)
diff --git a/src/slave/containerizer/mesos/containerizer.cpp b/src/slave/containerizer/mesos/containerizer.cpp
index 2b28e41..1fba8b7 100644
--- a/src/slave/containerizer/mesos/containerizer.cpp
+++ b/src/slave/containerizer/mesos/containerizer.cpp
@@ -1823,6 +1823,16 @@ Future<Containerizer::LaunchResult> MesosContainerizerProcess::_launch(
}
// Determine the user to launch the container as.
+ // Inherit user from the parent container for nested containers, and it can be
+ // overridden by the user in nested container's `commandInfo`, if specified.
+ if (containerId.has_parent()) {
+ if (containers_[containerId.parent()]->config.isSome() &&
+ containers_[containerId.parent()]->config->has_user()) {
+ launchInfo.set_user(
+ containers_[containerId.parent()]->config->user());
+ }
+ }
+
if (container->config->has_user()) {
launchInfo.set_user(container->config->user());
}
diff --git a/src/slave/http.cpp b/src/slave/http.cpp
index 386e9aa..691de82 100644
--- a/src/slave/http.cpp
+++ b/src/slave/http.cpp
@@ -2485,8 +2485,6 @@ Future<Response> Http::_launchContainer(
ContentType acceptType,
const Owned<ObjectApprovers>& approvers) const
{
- Option<string> user;
-
// Attempt to get the executor associated with this ContainerID.
// We only expect to get the executor when launching a nested container
// under a container launched via a scheduler. In other cases, we are
@@ -2504,24 +2502,14 @@ Future<Response> Http::_launchContainer(
executor->info, framework->info, commandInfo, containerId)) {
return Forbidden();
}
-
- // By default, we use the executor's user.
- // The CommandInfo can override it, if specified.
- user = executor->user;
}
ContainerConfig containerConfig;
containerConfig.mutable_command_info()->CopyFrom(commandInfo);
#ifndef __WINDOWS__
- if (slave->flags.switch_user) {
- if (commandInfo.has_user()) {
- user = commandInfo.user();
- }
-
- if (user.isSome()) {
- containerConfig.set_user(user.get());
- }
+ if (slave->flags.switch_user && commandInfo.has_user()) {
+ containerConfig.set_user(commandInfo.user());
}
#endif // __WINDOWS__
[mesos] 04/04: Added MESOS-9332 to the 1.6.2 CHANGELOG.
Posted by qi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
qianzhang pushed a commit to branch 1.6.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit a3cb327926456725b19bc900b6c0f80c4f5815aa
Author: Qian Zhang <zh...@gmail.com>
AuthorDate: Thu Nov 8 17:39:24 2018 +0800
Added MESOS-9332 to the 1.6.2 CHANGELOG.
---
CHANGELOG | 1 +
1 file changed, 1 insertion(+)
diff --git a/CHANGELOG b/CHANGELOG
index 8b1ff25..009b3ae 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -31,6 +31,7 @@ Release Notes - Mesos - Version 1.6.2 (WIP)
* [MESOS-9279] - Docker Containerizer 'usage' call might be expensive if mount table is big.
* [MESOS-9283] - Docker containerizer actor can get backlogged with large number of containers.
* [MESOS-9308] - URI disk profile adaptor could deadlock.
+ * [MESOS-9332] - Nested container should run as the same user of its parent container by default.
* [MESOS-9334] - Container stuck at ISOLATING state due to libevent poll never returns.
** Improvement