gobblin.yarn.YarnContainerSecurityManager.java Source code

Introduction

Here is the source code for gobblin.yarn.YarnContainerSecurityManager.java

Source

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package gobblin.yarn;

import java.io.IOException;
import java.util.Collection;

import org.apache.hadoop.fs.FileSystem;
import org.apache.hadoop.fs.Path;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.security.token.TokenIdentifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.typesafe.config.Config;

import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.Throwables;
import com.google.common.eventbus.EventBus;
import com.google.common.eventbus.Subscribe;
import com.google.common.util.concurrent.AbstractIdleService;

import gobblin.yarn.event.DelegationTokenUpdatedEvent;

/**
 * A class for managing token renewing in the containers including the container for the
 * {@link GobblinApplicationMaster}.
 *
 * <p>
 *   This class implements a simple monitor for modifications on the token file and reloads tokens
 *   in the token file if the file has been modified and adds the tokens to the credentials of the
 *   current login user.
 * </p>
 *
 * @author Yinan Li
 */
public class YarnContainerSecurityManager extends AbstractIdleService {

    private static final Logger LOGGER = LoggerFactory.getLogger(YarnContainerSecurityManager.class);

    private final FileSystem fs;
    private final Path tokenFilePath;
    private final EventBus eventBus;

    public YarnContainerSecurityManager(Config config, FileSystem fs, EventBus eventBus) {
        this.fs = fs;
        this.tokenFilePath = new Path(this.fs.getHomeDirectory(),
                config.getString(GobblinYarnConfigurationKeys.APPLICATION_NAME_KEY) + Path.SEPARATOR
                        + GobblinYarnConfigurationKeys.TOKEN_FILE_NAME);
        this.eventBus = eventBus;
    }

    @SuppressWarnings("unused")
    @Subscribe
    public void handleTokenFileUpdatedEvent(DelegationTokenUpdatedEvent delegationTokenUpdatedEvent) {
        try {
            addDelegationTokens(readDelegationTokens(this.tokenFilePath));
        } catch (IOException ioe) {
            throw Throwables.propagate(ioe);
        }
    }

    @Override
    protected void startUp() throws Exception {
        this.eventBus.register(this);
    }

    @Override
    protected void shutDown() throws Exception {
        // Nothing to do
    }

    /**
     * Read the {@link Token}s stored in the token file.
     */
    @VisibleForTesting
    Collection<Token<? extends TokenIdentifier>> readDelegationTokens(Path tokenFilePath) throws IOException {
        LOGGER.info("Reading updated token from token file: " + tokenFilePath);
        return YarnHelixUtils.readTokensFromFile(tokenFilePath, this.fs.getConf());
    }

    @VisibleForTesting
    void addDelegationTokens(Collection<Token<? extends TokenIdentifier>> tokens) throws IOException {
        for (Token<? extends TokenIdentifier> token : tokens) {
            if (!UserGroupInformation.getCurrentUser().addToken(token)) {
                LOGGER.error(String.format("Failed to add token %s to user %s", token.toString(),
                        UserGroupInformation.getLoginUser().getShortUserName()));
            }
        }
    }
}