[skywalking] branch master updated: Support Zookeeper ACL (#3273)

[wu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wusheng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git


The following commit(s) were added to refs/heads/master by this push:
     new 49b20dd  Support Zookeeper ACL (#3273)
49b20dd is described below

commit 49b20dd0cb825b154c22ac50dfcdd53f3438c947
Author: Daming <zt...@foxmail.com>
AuthorDate: Wed Aug 21 09:23:43 2019 +0800

    Support Zookeeper ACL (#3273)
    
    * support ACL
    
    * support digest only
---
 docker/oap/docker-entrypoint.sh                    |  4 ++
 docs/en/setup/backend/backend-cluster.md           | 15 +++++
 .../zookeeper/ClusterModuleZookeeperConfig.java    |  4 ++
 .../zookeeper/ClusterModuleZookeeperProvider.java  | 64 ++++++++++++++++++++--
 .../src/main/assembly/application.yml              |  4 ++
 .../src/main/resources/application.yml             |  4 ++
 6 files changed, 89 insertions(+), 6 deletions(-)

diff --git a/docker/oap/docker-entrypoint.sh b/docker/oap/docker-entrypoint.sh
index 931299a..7c2756b 100755
--- a/docker/oap/docker-entrypoint.sh
+++ b/docker/oap/docker-entrypoint.sh
@@ -34,6 +34,10 @@ cluster:
     #Retry Policy
     baseSleepTimeMs: \${SW_CLUSTER_ZK_SLEEP_TIME:1000} # initial amount of time to wait between retries
     maxRetries: \${SW_CLUSTER_ZK_MAX_RETRIES:3} # max number of times to retry
+    # Enable ACL
+    enableACL: \${SW_ZK_ENABLE_ACL:false} # disable ACL in default
+    schema: \${SW_ZK_SCHEMA:digest} # only support digest schema
+    expression: \${SW_ZK_EXPRESSION:skywalking:skywalking}
 EOT
 }
 
diff --git a/docs/en/setup/backend/backend-cluster.md b/docs/en/setup/backend/backend-cluster.md
index df7bc90..9f50fc7 100644
--- a/docs/en/setup/backend/backend-cluster.md
+++ b/docs/en/setup/backend/backend-cluster.md
@@ -26,11 +26,22 @@ cluster:
     # Retry Policy
     baseSleepTimeMs: 1000 # initial amount of time to wait between retries
     maxRetries: 3 # max number of times to retry
+    # Enable ACL
+    enableACL: ${SW_ZK_ENABLE_ACL:false} # disable ACL in default
+    schema: ${SW_ZK_SCHEMA:digest} # only support digest schema
+    expression: ${SW_ZK_EXPRESSION:skywalking:skywalking}
 ```
 
 - `hostPort` is the list of zookeeper servers. Format is `IP1:PORT1,IP2:PORT2,...,IPn:PORTn`
+- `enableACL` enable [Zookeeper ACL](https://zookeeper.apache.org/doc/r3.4.1/zookeeperProgrammers.html#sc_ZooKeeperAccessControl) to control access to its znode.
+- `schema` is Zookeeper ACL schemas.
+- `expression` is a expression of ACL. The format of the expression is specific to the [schema](https://zookeeper.apache.org/doc/r3.4.1/zookeeperProgrammers.html#sc_BuiltinACLSchemes). 
 - `hostPort`, `baseSleepTimeMs` and `maxRetries` are settings of Zookeeper curator client.
 
+Note: 
+- If `Zookeeper ACL` is enabled and `/skywalking` existed, must be sure `SkyWalking` has `CREATE`, `READ` and `WRITE` permissions. If `/skywalking` is not exists, it will be created by SkyWalking and grant all permissions to the specified user. Simultaneously, znode is granted READ to anyone.
+- If set `schema` as `digest`, the password of expression is set in **clear text**. 
+
 In some cases, oap default gRPC host and port in core are not suitable for internal communication among the oap nodes.
 The following setting are provided to set the hot and port manually, based on your own LAN env.
 - internalComHost, the host registered and other oap node use this to communicate with current node.
@@ -45,6 +56,10 @@ zookeeper:
   maxRetries: ${SW_CLUSTER_ZK_MAX_RETRIES:3} # max number of times to retry
   internalComHost: 172.10.4.10
   internalComPort: 11800
+  # Enable ACL
+  enableACL: ${SW_ZK_ENABLE_ACL:false} # disable ACL in default
+  schema: ${SW_ZK_SCHEMA:digest} # only support digest schema
+  expression: ${SW_ZK_EXPRESSION:skywalking:skywalking}
 ``` 
 
 
diff --git a/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperConfig.java b/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperConfig.java
index 22df79c..eb84fde 100644
--- a/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperConfig.java
+++ b/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperConfig.java
@@ -34,6 +34,10 @@ class ClusterModuleZookeeperConfig extends ModuleConfig {
     @Setter @Getter private String internalComHost;
     @Setter @Getter private int internalComPort = -1;
 
+    @Setter @Getter private boolean enableACL = false;
+    @Setter @Getter private String schema;
+    @Setter @Getter private String expression;
+
     public String getHostPort() {
         return Strings.isNullOrEmpty(hostPort) ? "localhost:2181" : hostPort;
     }
diff --git a/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperProvider.java b/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperProvider.java
index f1f2740..abbd7d3 100644
--- a/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperProvider.java
+++ b/oap-server/server-cluster-plugin/cluster-zookeeper-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/zookeeper/ClusterModuleZookeeperProvider.java
@@ -18,14 +18,32 @@
 
 package org.apache.skywalking.oap.server.cluster.plugin.zookeeper;
 
+import com.google.common.collect.Lists;
 import org.apache.curator.RetryPolicy;
-import org.apache.curator.framework.*;
+import org.apache.curator.framework.CuratorFramework;
+import org.apache.curator.framework.CuratorFrameworkFactory;
+import org.apache.curator.framework.api.ACLProvider;
 import org.apache.curator.retry.ExponentialBackoffRetry;
-import org.apache.curator.x.discovery.*;
+import org.apache.curator.x.discovery.ServiceDiscovery;
+import org.apache.curator.x.discovery.ServiceDiscoveryBuilder;
 import org.apache.skywalking.apm.util.StringUtil;
-import org.apache.skywalking.oap.server.core.cluster.*;
-import org.apache.skywalking.oap.server.library.module.*;
-import org.slf4j.*;
+import org.apache.skywalking.oap.server.core.cluster.ClusterModule;
+import org.apache.skywalking.oap.server.core.cluster.ClusterNodesQuery;
+import org.apache.skywalking.oap.server.core.cluster.ClusterRegister;
+import org.apache.skywalking.oap.server.core.cluster.RemoteInstance;
+import org.apache.skywalking.oap.server.library.module.ModuleConfig;
+import org.apache.skywalking.oap.server.library.module.ModuleProvider;
+import org.apache.skywalking.oap.server.library.module.ModuleStartException;
+import org.apache.skywalking.oap.server.library.module.ServiceNotProvidedException;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.NoSuchAlgorithmException;
+import java.util.List;
 
 /**
  * Use Zookeeper to manage all instances in SkyWalking cluster.
@@ -61,7 +79,41 @@ public class ClusterModuleZookeeperProvider extends ModuleProvider {
 
     @Override public void prepare() throws ServiceNotProvidedException, ModuleStartException {
         RetryPolicy retryPolicy = new ExponentialBackoffRetry(config.getBaseSleepTimeMs(), config.getMaxRetries());
-        client = CuratorFrameworkFactory.newClient(config.getHostPort(), retryPolicy);
+
+        CuratorFrameworkFactory.Builder builder = CuratorFrameworkFactory.builder()
+            .retryPolicy(retryPolicy)
+            .connectString(config.getHostPort());
+
+        if (config.isEnableACL()) {
+            String authInfo = config.getExpression();
+            if ("digest".equals(config.getSchema())) {
+                try {
+                    authInfo = DigestAuthenticationProvider.generateDigest(authInfo);
+                } catch (NoSuchAlgorithmException e) {
+                    throw new ModuleStartException(e.getMessage(), e);
+                }
+            } else {
+                throw new ModuleStartException("Support digest schema only.");
+            }
+            final List<ACL> acls = Lists.newArrayList();
+            acls.add(new ACL(ZooDefs.Perms.ALL, new Id(config.getSchema(), authInfo)));
+            acls.add(new ACL(ZooDefs.Perms.READ, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+
+            ACLProvider provider = new ACLProvider() {
+                @Override
+                public List<ACL> getDefaultAcl() {
+                    return acls;
+                }
+
+                @Override
+                public List<ACL> getAclForPath(String s) {
+                    return acls;
+                }
+            };
+            builder.aclProvider(provider);
+            builder.authorization(config.getSchema(), config.getExpression().getBytes());
+        }
+        client = builder.build();
 
         String path = BASE_PATH + (StringUtil.isEmpty(config.getNameSpace()) ? "" : "/" + config.getNameSpace());
 
diff --git a/oap-server/server-starter/src/main/assembly/application.yml b/oap-server/server-starter/src/main/assembly/application.yml
index ef80813..c70c4a1 100644
--- a/oap-server/server-starter/src/main/assembly/application.yml
+++ b/oap-server/server-starter/src/main/assembly/application.yml
@@ -24,6 +24,10 @@ cluster:
 #    #Retry Policy
 #    baseSleepTimeMs: ${SW_CLUSTER_ZK_SLEEP_TIME:1000} # initial amount of time to wait between retries
 #    maxRetries: ${SW_CLUSTER_ZK_MAX_RETRIES:3} # max number of times to retry
+#    # Enable ACL
+#    enableACL: ${SW_ZK_ENABLE_ACL:false} # disable ACL in default
+#    schema: ${SW_ZK_SCHEMA:digest} # only support digest schema
+#    expression: ${SW_ZK_EXPRESSION:skywalking:skywalking}
 #  kubernetes:
 #    watchTimeoutSeconds: ${SW_CLUSTER_K8S_WATCH_TIMEOUT:60}
 #    namespace: ${SW_CLUSTER_K8S_NAMESPACE:default}
diff --git a/oap-server/server-starter/src/main/resources/application.yml b/oap-server/server-starter/src/main/resources/application.yml
index 5ea17c9..9541fc1 100755
--- a/oap-server/server-starter/src/main/resources/application.yml
+++ b/oap-server/server-starter/src/main/resources/application.yml
@@ -23,6 +23,10 @@ cluster:
 #    #Retry Policy
 #    baseSleepTimeMs: ${SW_CLUSTER_ZK_SLEEP_TIME:1000} # initial amount of time to wait between retries
 #    maxRetries: ${SW_CLUSTER_ZK_MAX_RETRIES:3} # max number of times to retry
+#    # Enable ACL
+#    enableACL: ${SW_ZK_ENABLE_ACL:false} # disable ACL in default
+#    schema: ${SW_ZK_SCHEMA:digest} # only support digest schema
+#    expression: ${SW_ZK_EXPRESSION:skywalking:skywalking}
 #  kubernetes:
 #    watchTimeoutSeconds: ${SW_CLUSTER_K8S_WATCH_TIMEOUT:60}
 #    namespace: ${SW_CLUSTER_K8S_NAMESPACE:default}