diff options
| author | Dhruve Ashar <dhruveashar@gmail.com> | 2016-05-04 08:45:43 -0500 |
|---|---|---|
| committer | Tom Graves <tgraves@yahoo-inc.com> | 2016-05-04 08:45:43 -0500 |
| commit | a45647746d1efb90cb8bc142c2ef110a0db9bc9f (patch) | |
| tree | 1c6cdb00bce295b2d16a98860848a19c72c4aa30 /docs/monitoring.md | |
| parent | abecbcd5e9598471b705a2f701731af1adc9d48b (diff) | |
| download | spark-a45647746d1efb90cb8bc142c2ef110a0db9bc9f.tar.gz spark-a45647746d1efb90cb8bc142c2ef110a0db9bc9f.tar.bz2 spark-a45647746d1efb90cb8bc142c2ef110a0db9bc9f.zip | |
[SPARK-4224][CORE][YARN] Support group acls
## What changes were proposed in this pull request?
Currently only a list of users can be specified for view and modify acls. This change enables a group of admins/devs/users to be provisioned for viewing and modifying Spark jobs.
**Changes Proposed in the fix**
Three new corresponding config entries have been added where the user can specify the groups to be given access.
```
spark.admin.acls.groups
spark.modify.acls.groups
spark.ui.view.acls.groups
```
New config entries were added because specifying the users and groups explicitly is a better and cleaner way compared to specifying them in the existing config entry using a delimiter.
A generic trait has been introduced to provide the user to group mapping which makes it pluggable to support a variety of mapping protocols - similar to the one used in hadoop. A default unix shell based implementation has been provided.
Custom user to group mapping protocol can be specified and configured by the entry ```spark.user.groups.mapping```
**How the patch was Tested**
We ran different spark jobs setting the config entries in combinations of admin, modify and ui acls. For modify acls we tried killing the job stages from the ui and using yarn commands. For view acls we tried accessing the UI tabs and the logs. Headless accounts were used to launch these jobs and different users tried to modify and view the jobs to ensure that the groups mapping applied correctly.
Additional Unit tests have been added without modifying the existing ones. These test for different ways of setting the acls through configuration and/or API and validate the expected behavior.
Author: Dhruve Ashar <dhruveashar@gmail.com>
Closes #12760 from dhruve/impr/SPARK-4224.
Diffstat (limited to 'docs/monitoring.md')
| -rw-r--r-- | docs/monitoring.md | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/docs/monitoring.md b/docs/monitoring.md index 88002ebdc3..697962ae3a 100644 --- a/docs/monitoring.md +++ b/docs/monitoring.md @@ -162,8 +162,8 @@ The history server can be configured as follows: If enabled, access control checks are made regardless of what the individual application had set for <code>spark.ui.acls.enable</code> when the application was run. The application owner will always have authorization to view their own application and any users specified via - <code>spark.ui.view.acls</code> when the application was run will also have authorization - to view that application. + <code>spark.ui.view.acls</code> and groups specified via <code>spark.ui.view.acls.groups<code> + when the application was run will also have authorization to view that application. If disabled, no access control checks are made. </td> </tr> |