You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ambari.apache.org by sr...@apache.org on 2014/10/17 19:08:16 UTC
[1/3] git commit: AMBARI-7824. Slider View: Unable to create app when
cluster is secured - keytab doesnt exist (srimanth)
Repository: ambari
Updated Branches:
refs/heads/trunk 15ce79a95 -> 0844d54ed
AMBARI-7824. Slider View: Unable to create app when cluster is secured - keytab doesnt exist (srimanth)
Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/83924e09
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/83924e09
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/83924e09
Branch: refs/heads/trunk
Commit: 83924e09bcaa06b4e7aca855e8f8e1cae0d2edc8
Parents: 15ce79a
Author: Srimanth Gunturi <sg...@hortonworks.com>
Authored: Thu Oct 16 18:52:57 2014 -0700
Committer: Srimanth Gunturi <sg...@hortonworks.com>
Committed: Fri Oct 17 10:07:46 2014 -0700
----------------------------------------------------------------------
.../0.51.0/slider-agent-0.51.0.tar.gz | Bin 472393 -> 471859 bytes
.../slider-core/0.51.0/slider-core-0.51.0.jar | Bin 1155217 -> 1167680 bytes
contrib/views/slider/pom.xml | 5 ++
.../slider/SliderAppsViewControllerImpl.java | 49 +++++++++++++++++--
4 files changed, 50 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ambari/blob/83924e09/contrib/views/slider/lib/org/apache/slider/slider-agent/0.51.0/slider-agent-0.51.0.tar.gz
----------------------------------------------------------------------
diff --git a/contrib/views/slider/lib/org/apache/slider/slider-agent/0.51.0/slider-agent-0.51.0.tar.gz b/contrib/views/slider/lib/org/apache/slider/slider-agent/0.51.0/slider-agent-0.51.0.tar.gz
index f724da9..9d22825 100644
Binary files a/contrib/views/slider/lib/org/apache/slider/slider-agent/0.51.0/slider-agent-0.51.0.tar.gz and b/contrib/views/slider/lib/org/apache/slider/slider-agent/0.51.0/slider-agent-0.51.0.tar.gz differ
http://git-wip-us.apache.org/repos/asf/ambari/blob/83924e09/contrib/views/slider/lib/org/apache/slider/slider-core/0.51.0/slider-core-0.51.0.jar
----------------------------------------------------------------------
diff --git a/contrib/views/slider/lib/org/apache/slider/slider-core/0.51.0/slider-core-0.51.0.jar b/contrib/views/slider/lib/org/apache/slider/slider-core/0.51.0/slider-core-0.51.0.jar
index 7c2e42f..cbcca5c 100644
Binary files a/contrib/views/slider/lib/org/apache/slider/slider-core/0.51.0/slider-core-0.51.0.jar and b/contrib/views/slider/lib/org/apache/slider/slider-core/0.51.0/slider-core-0.51.0.jar differ
http://git-wip-us.apache.org/repos/asf/ambari/blob/83924e09/contrib/views/slider/pom.xml
----------------------------------------------------------------------
diff --git a/contrib/views/slider/pom.xml b/contrib/views/slider/pom.xml
index 3f311c8..cb07dd4 100644
--- a/contrib/views/slider/pom.xml
+++ b/contrib/views/slider/pom.xml
@@ -252,6 +252,11 @@
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-registry</artifactId>
+ <version>${hadoop.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-yarn-common</artifactId>
<version>${hadoop.version}</version>
</dependency>
http://git-wip-us.apache.org/repos/asf/ambari/blob/83924e09/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
----------------------------------------------------------------------
diff --git a/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java b/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
index 92f95c9..bdd3c0f 100644
--- a/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
+++ b/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
@@ -66,6 +66,7 @@ import org.apache.slider.client.SliderClient;
import org.apache.slider.common.params.ActionCreateArgs;
import org.apache.slider.common.params.ActionFlexArgs;
import org.apache.slider.common.params.ActionFreezeArgs;
+import org.apache.slider.common.params.ActionInstallKeytabArgs;
import org.apache.slider.common.params.ActionInstallPackageArgs;
import org.apache.slider.common.params.ActionThawArgs;
import org.apache.slider.core.exceptions.SliderException;
@@ -84,6 +85,7 @@ import com.google.gson.JsonArray;
import com.google.gson.JsonElement;
import com.google.gson.JsonObject;
import com.google.gson.JsonParser;
+import com.google.gson.JsonPrimitive;
import com.google.inject.Inject;
import com.google.inject.Singleton;
@@ -134,7 +136,7 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
ambariUsername, ambariPassword);
try {
AmbariClusterInfo clusterInfo = ambariClient.getClusterInfo();
- if (clusterName.equals(clusterInfo.getName())) {
+ if (clusterInfo!=null && clusterName.equals(clusterInfo.getName())) {
AmbariCluster cluster = ambariClient.getCluster(clusterInfo);
AmbariServiceInfo hdfsServiceInfo = null;
AmbariServiceInfo yarnServiceInfo = null;
@@ -1039,6 +1041,7 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
final String appType = json.get("typeName").getAsString();
final String appName = json.get("name").getAsString();
final String queueName = json.has("queue") ? json.get("queue").getAsString() : null;
+ final boolean securityEnabled = Boolean.valueOf(getHadoopConfigs().get("security_enabled"));
JsonObject configs = json.get("typeConfigs").getAsJsonObject();
JsonObject resourcesObj = json.get("resources").getAsJsonObject();
JsonArray componentsArray = resourcesObj.get("components").getAsJsonArray();
@@ -1070,7 +1073,7 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
appCreateFolder.mkdirs();
File appConfigJsonFile = new File(appCreateFolder, "appConfig.json");
File resourcesJsonFile = new File(appCreateFolder, "resources.json");
- saveAppConfigs(configs, componentsArray, appConfigJsonFile);
+ saveAppConfigs(configs, componentsArray, appName, securityEnabled, appConfigJsonFile);
saveAppResources(resourcesObj, resourcesJsonFile);
final ActionCreateArgs createArgs = new ActionCreateArgs();
@@ -1087,9 +1090,16 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
installArgs.packageURI = getAppsFolderPath() + "/" + localAppPackageFileName;
installArgs.replacePkg = true;
+ final ActionInstallKeytabArgs keytabArgs = new ActionInstallKeytabArgs();
+ keytabArgs.keytabUri = getUserToRunAsKeytab();
+ keytabArgs.folder = appName;
+
return invokeSliderClientRunnable(new SliderClientContextRunnable<String>() {
@Override
public String run(SliderClient sliderClient) throws YarnException, IOException, InterruptedException {
+ if (securityEnabled) {
+ sliderClient.actionInstallKeytab(keytabArgs);
+ }
sliderClient.actionInstallPkg(installArgs);
sliderClient.actionCreate(appName, createArgs);
ApplicationId applicationId = sliderClient.applicationId;
@@ -1157,8 +1167,28 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
}
}
+ /*
+ * When security is enabled, the AppMaster itself needs the keytab identifying the calling user.
+ * The user's keytab should be at the same location as the view's keytab, and should be
+ * named as ${username}.headless.keytab
+ */
+ private String getUserToRunAsKeytab() {
+ String viewKeytab = viewContext.getProperties().get(PARAM_VIEW_PRINCIPAL_KEYTAB);
+ String prefix = "";
+ int index = viewKeytab.lastIndexOf('/');
+ if (index > -1) {
+ prefix = viewKeytab.substring(0, index);
+ }
+ String username = getUserToRunAs();
+ String userKeytab = prefix + "/" + username + ".headless.keytab";
+ if (logger.isDebugEnabled()) {
+ logger.debug(username + " keytab: " + userKeytab);
+ }
+ return userKeytab;
+ }
+
private void saveAppConfigs(JsonObject configs, JsonArray componentsArray,
- File appConfigJsonFile) throws IOException {
+ String appName, boolean securityEnabled, File appConfigJsonFile) throws IOException {
JsonObject appConfigs = new JsonObject();
appConfigs.addProperty("schema", "http://example.org/specification/v2.0.0");
appConfigs.add("metadata", new JsonObject());
@@ -1173,7 +1203,15 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
}
}
}
- appConfigs.add("components", componentsObj);
+ if (securityEnabled) {
+ JsonObject appMasterComponent = new JsonObject();
+ String userToRunAsKeytab = getUserToRunAsKeytab();
+ String fileName = userToRunAsKeytab.substring(userToRunAsKeytab.lastIndexOf('/') + 1);
+ appMasterComponent.add("slider.am.login.keytab.name", new JsonPrimitive(fileName));
+ appMasterComponent.add("slider.hdfs.keytab.dir", new JsonPrimitive(".slider/keytabs/" + appName));
+ componentsObj.add("slider-appmaster", appMasterComponent);
+ }
+ appConfigs.add("components", componentsObj);
String jsonString = new GsonBuilder().setPrettyPrinting().create().toJson(appConfigs);
FileOutputStream fos = null;
try {
@@ -1184,6 +1222,9 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
fos.close();
}
}
+ if (logger.isDebugEnabled()) {
+ logger.debug("Saved appConfigs.json at " + appConfigJsonFile.getAbsolutePath());
+ }
}
@Override
[2/3] git commit: AMBARI-7836. Slider View: Unable to create app,
500 error on POST request (srimanth)
Posted by sr...@apache.org.
AMBARI-7836. Slider View: Unable to create app, 500 error on POST request (srimanth)
Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/007cb13f
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/007cb13f
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/007cb13f
Branch: refs/heads/trunk
Commit: 007cb13f1bcb87f067538f648237ce4a700f14d4
Parents: 83924e0
Author: Srimanth Gunturi <sg...@hortonworks.com>
Authored: Fri Oct 17 09:45:51 2014 -0700
Committer: Srimanth Gunturi <sg...@hortonworks.com>
Committed: Fri Oct 17 10:07:55 2014 -0700
----------------------------------------------------------------------
.../ambari/view/slider/SliderAppsViewControllerImpl.java | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ambari/blob/007cb13f/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
----------------------------------------------------------------------
diff --git a/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java b/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
index bdd3c0f..ad3acd0 100644
--- a/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
+++ b/contrib/views/slider/src/main/java/org/apache/ambari/view/slider/SliderAppsViewControllerImpl.java
@@ -1091,8 +1091,10 @@ public class SliderAppsViewControllerImpl implements SliderAppsViewController {
installArgs.replacePkg = true;
final ActionInstallKeytabArgs keytabArgs = new ActionInstallKeytabArgs();
- keytabArgs.keytabUri = getUserToRunAsKeytab();
- keytabArgs.folder = appName;
+ if (securityEnabled) {
+ keytabArgs.keytabUri = getUserToRunAsKeytab();
+ keytabArgs.folder = appName;
+ }
return invokeSliderClientRunnable(new SliderClientContextRunnable<String>() {
@Override
[3/3] git commit: AMBARI-7824. Slider View: Unable to create app when
cluster is secured - keytab doesnt exist. Doc updates (srimanth)
Posted by sr...@apache.org.
AMBARI-7824. Slider View: Unable to create app when cluster is secured - keytab doesnt exist. Doc updates (srimanth)
Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/0844d54e
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/0844d54e
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/0844d54e
Branch: refs/heads/trunk
Commit: 0844d54edf3d6b974d7402f8ae607c13bd4d1246
Parents: 007cb13
Author: Srimanth Gunturi <sg...@hortonworks.com>
Authored: Thu Oct 16 23:36:09 2014 -0700
Committer: Srimanth Gunturi <sg...@hortonworks.com>
Committed: Fri Oct 17 10:08:05 2014 -0700
----------------------------------------------------------------------
contrib/views/slider/docs/index.md | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ambari/blob/0844d54e/contrib/views/slider/docs/index.md
----------------------------------------------------------------------
diff --git a/contrib/views/slider/docs/index.md b/contrib/views/slider/docs/index.md
index 0c9132c..bd23d14 100644
--- a/contrib/views/slider/docs/index.md
+++ b/contrib/views/slider/docs/index.md
@@ -80,4 +80,35 @@ From *Ambari-Admin* create a *Slider Apps View* with the below parameters popula
* slider.security.enabled = true
* view.kerberos.principal = `view-principal`
-* view.kerberos.principal.keytab = `/etc/security/keytabs/view-principal.headless.keytab`
\ No newline at end of file
+* view.kerberos.principal.keytab = `/etc/security/keytabs/view-principal.headless.keytab`
+
+#### Step-5 Create *Kerberos* principal for *slider.user*
+We need to provide a *Kerberos* identity for the user identified in *slider.user* view parameter.
+
+The *slider.user* view parameter has the following interpretations:
+
+* If the parameter is left blank, it means the user *yarn*.
+* If it is `${username}`, it is the user logged into Ambari.
+* Else, it is exact name of the user.
+
+We shall assume the user as `slider-user`. In a secured cluster this user has to actually exist on all the hosts. The user should also have an *uid* greater than 1000.
+
+On the machine where *KDC Server* is hosted, create user principal by running below command
+
+```
+kadmin.local -q "addprinc -randkey slider-user@EXAMPLE.COM"
+```
+Next, extract keytab file
+
+```
+kadmin.local -q "xst -k /path/to/keytab/slider-user.headless.keytab view-principal@EXAMPLE.COM"
+```
+The keytab file should then be copied over to the keytabs location on the host where the view is hosted.
+
+```
+cp /path/to/keytab/slider-user.headless.keytab /etc/security/keytabs/
+```
+
+Change file permissions so that only necessary users can access it.
+
+**Make sure that `slider-user` keytab is at /etc/security/keytabs/`slider-user`.headless.keytab**