Examples of org.apache.hadoop.yarn.api.records.ContainerToken

Package org.apache.hadoop.yarn.api.records

Examples of org.apache.hadoop.yarn.api.records.ContainerToken

org.apache.hadoop.yarn.api.records.ContainerToken

ContainerToken is the security token used by the framework to verify authenticity of any Container.

The ResourceManager, on container allocation provides a secure token which is verified by the NodeManager on container launch.

Applications do not need to care about ContainerToken, they are transparently handled by the framework - the allocated Container includes the ContainerToken.
@see AMRMProtocol#allocate(org.apache.hadoop.yarn.api.protocolrecords.AllocateRequest) @see ContainerManager#startContainer(org.apache.hadoop.yarn.api.protocolrecords.StartContainerRequest)

        unreserve(application, priority, node, rmContainer);
      }


      // Create container tokens in secure-mode
      if (UserGroupInformation.isSecurityEnabled()) {
        ContainerToken containerToken = 
            createContainerToken(application, container);
        if (containerToken == null) {
          // Something went wrong...
          return Resources.none();
        }

View Full Code Here

    return container;
  }


  public static ContainerToken newContainerToken(NodeId nodeId,
      ByteBuffer password, ContainerTokenIdentifier tokenIdentifier) {
    ContainerToken containerToken = recordFactory
        .newRecordInstance(ContainerToken.class);
    containerToken.setIdentifier(ByteBuffer.wrap(tokenIdentifier.getBytes()));
    containerToken.setKind(ContainerTokenIdentifier.KIND.toString());
    containerToken.setPassword(password);
    // RPC layer client expects ip:port as service for tokens
    InetSocketAddress addr = NetUtils.createSocketAddr(nodeId.getHost(),
        nodeId.getPort());
    containerToken.setService(addr.getAddress().getHostAddress() + ":"
        + addr.getPort());
    return containerToken;
  }

View Full Code Here

    final YarnRPC rpc = YarnRPC.create(conf); // TODO: Don't create again and again.


    UserGroupInformation currentUser = UserGroupInformation
        .createRemoteUser(containerId.toString());
    if (UserGroupInformation.isSecurityEnabled()) {
      ContainerToken containerToken = container.getContainerToken();
      Token<ContainerTokenIdentifier> token =
          new Token<ContainerTokenIdentifier>(
              containerToken.getIdentifier().array(),
              containerToken.getPassword().array(), new Text(
                  containerToken.getKind()), new Text(
                  containerToken.getService()));
      currentUser.addToken(token);
    }
    return currentUser.doAs(new PrivilegedAction<ContainerManager>() {
      @Override
      public ContainerManager run() {

View Full Code Here

      Resource capability, Priority priority) {


    NodeId nodeId = node.getRMNode().getNodeID();
    ContainerId containerId = BuilderUtils.newContainerId(application
        .getApplicationAttemptId(), application.getNewContainerId());
    ContainerToken containerToken = null;


    // If security is enabled, send the container-tokens too.
    if (UserGroupInformation.isSecurityEnabled()) {
      ContainerTokenIdentifier tokenIdentifier = new ContainerTokenIdentifier(
          containerId, nodeId.toString(), capability);

View Full Code Here

      for (int i=0; i < assignedContainers; ++i) {


        NodeId nodeId = node.getRMNode().getNodeID();
        ContainerId containerId = BuilderUtils.newContainerId(application
            .getApplicationAttemptId(), application.getNewContainerId());
        ContainerToken containerToken = null;


        // If security is enabled, send the container-tokens too.
        if (UserGroupInformation.isSecurityEnabled()) {
          ContainerTokenIdentifier tokenIdentifier = new ContainerTokenIdentifier(
              containerId, nodeId.toString(), capability);

View Full Code Here

        unreserve(application, priority, node, rmContainer);
      }


      // Create container tokens in secure-mode
      if (UserGroupInformation.isSecurityEnabled()) {
        ContainerToken containerToken = 
            createContainerToken(application, container);
        if (containerToken == null) {
          // Something went wrong...
          return Resources.none();
        }

View Full Code Here

      for (int i=0; i < assignedContainers; ++i) {


        NodeId nodeId = node.getRMNode().getNodeID();
        ContainerId containerId = BuilderUtils.newContainerId(application
            .getApplicationAttemptId(), application.getNewContainerId());
        ContainerToken containerToken = null;


        // If security is enabled, send the container-tokens too.
        if (UserGroupInformation.isSecurityEnabled()) {
          containerToken =
              this.rmContext.getContainerTokenSecretManager()

View Full Code Here

      Resource capability, Priority priority) {


    NodeId nodeId = node.getRMNode().getNodeID();
    ContainerId containerId = BuilderUtils.newContainerId(application
        .getApplicationAttemptId(), application.getNewContainerId());
    ContainerToken containerToken = null;


    // If security is enabled, send the container-tokens too.
    if (UserGroupInformation.isSecurityEnabled()) {
      containerToken =
          containerTokenSecretManager.createContainerToken(containerId, nodeId,

View Full Code Here


    // Now talk to the NM for launching the container.
    final ContainerId containerID = allocatedContainer.getId();
    UserGroupInformation authenticatedUser = UserGroupInformation
        .createRemoteUser(containerID.toString());
    ContainerToken containerToken = allocatedContainer.getContainerToken();
    Token<ContainerTokenIdentifier> token = new Token<ContainerTokenIdentifier>(
        containerToken.getIdentifier().array(), containerToken.getPassword()
            .array(), new Text(containerToken.getKind()), new Text(
            containerToken.getService()));
    authenticatedUser.addToken(token);
    authenticatedUser.doAs(new PrivilegedExceptionAction<Void>() {
      @Override
      public Void run() throws Exception {
        ContainerManager client = (ContainerManager) yarnRPC.getProxy(

View Full Code Here

    // Now talk to the NM for launching the container with modified resource
    final ContainerId containerID = allocatedContainer.getId();
    UserGroupInformation maliceUser = UserGroupInformation
        .createRemoteUser(containerID.toString());


    ContainerToken containerToken = allocatedContainer.getContainerToken();
    byte[] identifierBytes = containerToken.getIdentifier().array();


    DataInputBuffer di = new DataInputBuffer();
    di.reset(identifierBytes, identifierBytes.length);


    ContainerTokenIdentifier dummyIdentifier = new ContainerTokenIdentifier();
    dummyIdentifier.readFields(di);


    // Malice user modifies the resource amount
    Resource modifiedResource = BuilderUtils.newResource(2048);
    ContainerTokenIdentifier modifiedIdentifier = new ContainerTokenIdentifier(
        dummyIdentifier.getContainerID(), dummyIdentifier.getNmHostAddress(),
        modifiedResource, Long.MAX_VALUE, dummyIdentifier.getMasterKeyId());
    Token<ContainerTokenIdentifier> modifiedToken = new Token<ContainerTokenIdentifier>(
        modifiedIdentifier.getBytes(), containerToken.getPassword().array(),
        new Text(containerToken.getKind()), new Text(containerToken
            .getService()));
    maliceUser.addToken(modifiedToken);
    maliceUser.doAs(new PrivilegedAction<Void>() {
      @Override
      public Void run() {

View Full Code Here

0 1 2 3 4 5 6

TOP

Related Classes of org.apache.hadoop.yarn.api.records.ContainerToken

org.apache.hadoop.mapreduce.v2.app.launcher.ContainerLauncherImpl$Container

org.apache.hadoop.mapreduce.v2.app.launcher.ContainerLauncherImpl$EventProcessor

org.apache.hadoop.yarn.server.resourcemanager.amlauncher.AMLauncher

org.apache.hadoop.yarn.server.resourcemanager.scheduler.capacity.LeafQueue

org.apache.hadoop.yarn.server.resourcemanager.scheduler.fair.AppSchedulable

org.apache.hadoop.yarn.server.resourcemanager.scheduler.fifo.FifoScheduler

org.apache.hadoop.yarn.server.TestContainerManagerSecurity

org.apache.hadoop.yarn.util.BuilderUtils

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.