Skip to content

Commit d1aa859

Browse files
bharatviswa504bharatviswa504
authored
HDDS-1975. Implement default acls for bucket/volume/key for OM HA code. (#1315)
1 parent d3ce53e commit d1aa859

17 files changed

+192
-142
lines changed

‎hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/client/rpc/TestOzoneRpcClientAbstract.java‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,6 @@
119119
import static org.junit.Assert.assertThat;
120120
import static org.junit.Assert.assertTrue;
121121
import static org.junit.Assert.fail;
122-
import static org.junit.Assume.assumeFalse;
123122

124123
import org.junit.Ignore;
125124
import org.junit.Test;
@@ -2221,8 +2220,6 @@ public void testListPartsWithInvalidUploadID() throws Exception {
22212220

22222221
@Test
22232222
public void testNativeAclsForVolume() throws Exception {
2224-
assumeFalse("Remove this once ACL HA is supported",
2225-
getClass().equals(TestOzoneRpcClientWithRatis.class));
22262223
String volumeName = UUID.randomUUID().toString();
22272224
store.createVolume(volumeName);
22282225

@@ -2237,8 +2234,6 @@ public void testNativeAclsForVolume() throws Exception {
22372234

22382235
@Test
22392236
public void testNativeAclsForBucket() throws Exception {
2240-
assumeFalse("Remove this once ACL HA is supported",
2241-
getClass().equals(TestOzoneRpcClientWithRatis.class));
22422237
String volumeName = UUID.randomUUID().toString();
22432238
String bucketName = UUID.randomUUID().toString();
22442239

@@ -2299,8 +2294,6 @@ private void validateDefaultAcls(OzoneObj parentObj, OzoneObj childObj,
22992294

23002295
@Test
23012296
public void testNativeAclsForKey() throws Exception {
2302-
assumeFalse("Remove this once ACL HA is supported",
2303-
getClass().equals(TestOzoneRpcClientWithRatis.class));
23042297
String volumeName = UUID.randomUUID().toString();
23052298
String bucketName = UUID.randomUUID().toString();
23062299
String key1 = "dir1/dir2" + UUID.randomUUID().toString();
@@ -2363,8 +2356,6 @@ public void testNativeAclsForKey() throws Exception {
23632356

23642357
@Test
23652358
public void testNativeAclsForPrefix() throws Exception {
2366-
assumeFalse("Remove this once ACL HA is supported",
2367-
getClass().equals(TestOzoneRpcClientWithRatis.class));
23682359
String volumeName = UUID.randomUUID().toString();
23692360
String bucketName = UUID.randomUUID().toString();
23702361

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/OMClientRequest.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import com.google.common.annotations.VisibleForTesting;
2727
import com.google.common.base.Preconditions;
2828

29+
import org.apache.commons.lang3.StringUtils;
2930
import org.apache.hadoop.ipc.ProtobufRpcEngine;
3031
import org.apache.hadoop.ozone.OzoneConsts;
3132
import org.apache.hadoop.ozone.audit.AuditAction;
@@ -142,7 +143,8 @@ public void checkAcls(OzoneManager ozoneManager,
142143
*/
143144
@VisibleForTesting
144145
public UserGroupInformation createUGI() {
145-
if (omRequest.hasUserInfo()) {
146+
if (omRequest.hasUserInfo() &&
147+
!StringUtils.isBlank(omRequest.getUserInfo().getUserName())) {
146148
return UserGroupInformation.createRemoteUser(
147149
omRequest.getUserInfo().getUserName());
148150
} else {

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/bucket/OMBucketCreateRequest.java‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,14 @@
1919
package org.apache.hadoop.ozone.om.request.bucket;
2020

2121
import java.io.IOException;
22+
import java.util.ArrayList;
23+
import java.util.List;
24+
import java.util.stream.Collectors;
2225

2326
import com.google.common.base.Optional;
27+
import org.apache.hadoop.ozone.OzoneAcl;
28+
import org.apache.hadoop.ozone.om.helpers.OmVolumeArgs;
29+
import org.apache.hadoop.ozone.om.helpers.OzoneAclUtil;
2430
import org.apache.hadoop.ozone.om.ratis.utils.OzoneManagerDoubleBufferHelper;
2531
import org.slf4j.Logger;
2632
import org.slf4j.LoggerFactory;
@@ -146,8 +152,11 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
146152
volumeName);
147153
acquiredBucketLock = metadataManager.getLock().acquireLock(BUCKET_LOCK,
148154
volumeName, bucketName);
155+
156+
OmVolumeArgs omVolumeArgs =
157+
metadataManager.getVolumeTable().get(volumeKey);
149158
//Check if the volume exists
150-
if (metadataManager.getVolumeTable().get(volumeKey) == null) {
159+
if (omVolumeArgs == null) {
151160
LOG.debug("volume: {} not found ", volumeName);
152161
throw new OMException("Volume doesn't exist",
153162
OMException.ResultCodes.VOLUME_NOT_FOUND);
@@ -160,6 +169,9 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
160169
OMException.ResultCodes.BUCKET_ALREADY_EXISTS);
161170
}
162171

172+
// Add default acls from volume.
173+
addDefaultAcls(omBucketInfo, omVolumeArgs);
174+
163175
// Update table cache.
164176
metadataManager.getBucketTable().addCacheEntry(new CacheKey<>(bucketKey),
165177
new CacheValue<>(Optional.of(omBucketInfo), transactionLogIndex));
@@ -205,6 +217,29 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
205217
}
206218

207219

220+
/**
221+
* Add default acls for bucket. These acls are inherited from volume
222+
* default acl list.
223+
* @param omBucketInfo
224+
* @param omVolumeArgs
225+
*/
226+
private void addDefaultAcls(OmBucketInfo omBucketInfo,
227+
OmVolumeArgs omVolumeArgs) {
228+
// Add default acls from volume.
229+
List<OzoneAcl> acls = new ArrayList<>();
230+
if (omBucketInfo.getAcls() != null) {
231+
acls.addAll(omBucketInfo.getAcls());
232+
}
233+
234+
List<OzoneAcl> defaultVolumeAclList = omVolumeArgs.getAclMap()
235+
.getDefaultAclList().stream().map(OzoneAcl::fromProtobuf)
236+
.collect(Collectors.toList());
237+
238+
OzoneAclUtil.inheritDefaultAcls(acls, defaultVolumeAclList);
239+
omBucketInfo.setAcls(acls);
240+
}
241+
242+
208243
private BucketInfo getBucketInfoFromRequest() {
209244
CreateBucketRequest createBucketRequest =
210245
getOmRequest().getCreateBucketRequest();

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/file/OMDirectoryCreateRequest.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,6 @@
5757
.OMRequest;
5858
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
5959
.OMResponse;
60-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
61-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
6260
import org.apache.hadoop.util.Time;
6361
import org.apache.hadoop.utils.db.cache.CacheKey;
6462
import org.apache.hadoop.utils.db.cache.CacheValue;
@@ -129,11 +127,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
129127
OMClientResponse omClientResponse = null;
130128
try {
131129
// check Acl
132-
if (ozoneManager.getAclsEnabled()) {
133-
checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
134-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
135-
volumeName, bucketName, keyName);
136-
}
130+
checkBucketAcls(ozoneManager, volumeName, bucketName, keyName);
137131

138132
// Check if this is the root of the filesystem.
139133
if (keyName.length() == 0) {

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/file/OMFileCreateRequest.java‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,6 @@
5353
.KeyArgs;
5454
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
5555
.OMRequest;
56-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
57-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
5856
import org.apache.hadoop.util.Time;
5957
import org.apache.hadoop.utils.UniqueId;
6058
import org.apache.hadoop.utils.db.Table;
@@ -179,11 +177,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
179177
OMClientResponse omClientResponse = null;
180178
try {
181179
// check Acl
182-
if (ozoneManager.getAclsEnabled()) {
183-
checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
184-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
185-
volumeName, bucketName, keyName);
186-
}
180+
checkBucketAcls(ozoneManager, volumeName, bucketName, keyName);
187181

188182
// acquire lock
189183
acquiredLock = omMetadataManager.getLock().acquireLock(BUCKET_LOCK,
@@ -265,20 +259,20 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
265259
omKeyInfo = prepareKeyInfo(omMetadataManager, keyArgs,
266260
omMetadataManager.getOzoneKey(volumeName, bucketName,
267261
keyName), keyArgs.getDataSize(), locations,
268-
encryptionInfo.orNull());
262+
encryptionInfo.orNull(), ozoneManager.getPrefixManager(), bucketInfo);
269263

270264
omClientResponse = prepareCreateKeyResponse(keyArgs, omKeyInfo,
271265
locations, encryptionInfo.orNull(), exception,
272266
createFileRequest.getClientID(), transactionLogIndex, volumeName,
273267
bucketName, keyName, ozoneManager,
274-
OMAction.CREATE_FILE);
268+
OMAction.CREATE_FILE, ozoneManager.getPrefixManager(), bucketInfo);
275269
} catch (IOException ex) {
276270
exception = ex;
277271
omClientResponse = prepareCreateKeyResponse(keyArgs, omKeyInfo,
278272
locations, encryptionInfo.orNull(), exception,
279273
createFileRequest.getClientID(), transactionLogIndex,
280274
volumeName, bucketName, keyName, ozoneManager,
281-
OMAction.CREATE_FILE);
275+
OMAction.CREATE_FILE, ozoneManager.getPrefixManager(), null);
282276
} finally {
283277
if (omClientResponse != null) {
284278
omClientResponse.setFlushFuture(

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMAllocateBlockRequest.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,6 @@
5353
.OMRequest;
5454
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
5555
.OMResponse;
56-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
57-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
5856
import org.apache.hadoop.utils.db.cache.CacheKey;
5957
import org.apache.hadoop.utils.db.cache.CacheValue;
6058

@@ -171,11 +169,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
171169
OmKeyInfo omKeyInfo = null;
172170
try {
173171
// check Acl
174-
if (ozoneManager.getAclsEnabled()) {
175-
checkAcls(ozoneManager, OzoneObj.ResourceType.KEY,
176-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
177-
volumeName, bucketName, keyName);
178-
}
172+
checkBucketAcls(ozoneManager, volumeName, bucketName, keyName);
179173

180174
OMMetadataManager omMetadataManager = ozoneManager.getMetadataManager();
181175
validateBucketAndVolume(omMetadataManager, volumeName,

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyCommitRequest.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,6 @@
4848
.KeyArgs;
4949
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
5050
.OMRequest;
51-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
52-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
5351
import org.apache.hadoop.util.Time;
5452
import org.apache.hadoop.utils.db.cache.CacheKey;
5553
import org.apache.hadoop.utils.db.cache.CacheValue;
@@ -117,11 +115,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
117115
OMMetadataManager omMetadataManager = ozoneManager.getMetadataManager();
118116
try {
119117
// check Acl
120-
if (ozoneManager.getAclsEnabled()) {
121-
checkAcls(ozoneManager, OzoneObj.ResourceType.KEY,
122-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
123-
volumeName, bucketName, keyName);
124-
}
118+
checkBucketAcls(ozoneManager, volumeName, bucketName, keyName);
125119

126120
List<OmKeyLocationInfo> locationInfoList = commitKeyArgs
127121
.getKeyLocationsList().stream()

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyCreateRequest.java‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,6 @@
4747
.KeyArgs;
4848
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
4949
.OMRequest;
50-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
51-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
5250
import org.apache.hadoop.util.Time;
5351
import org.apache.hadoop.utils.UniqueId;
5452

@@ -164,11 +162,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
164162
OMClientResponse omClientResponse = null;
165163
try {
166164
// check Acl
167-
if (ozoneManager.getAclsEnabled()) {
168-
checkAcls(ozoneManager, OzoneObj.ResourceType.KEY,
169-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
170-
volumeName, bucketName, keyName);
171-
}
165+
checkBucketAcls(ozoneManager, volumeName, bucketName, keyName);
172166

173167
acquireLock = omMetadataManager.getLock().acquireLock(BUCKET_LOCK,
174168
volumeName, bucketName);
@@ -184,17 +178,19 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
184178

185179
omKeyInfo = prepareKeyInfo(omMetadataManager, keyArgs,
186180
omMetadataManager.getOzoneKey(volumeName, bucketName, keyName),
187-
keyArgs.getDataSize(), locations, encryptionInfo.orNull());
181+
keyArgs.getDataSize(), locations, encryptionInfo.orNull(),
182+
ozoneManager.getPrefixManager(), bucketInfo);
188183
omClientResponse = prepareCreateKeyResponse(keyArgs, omKeyInfo,
189184
locations, encryptionInfo.orNull(), exception,
190185
createKeyRequest.getClientID(), transactionLogIndex, volumeName,
191-
bucketName, keyName, ozoneManager, OMAction.ALLOCATE_KEY);
186+
bucketName, keyName, ozoneManager, OMAction.ALLOCATE_KEY,
187+
ozoneManager.getPrefixManager(), bucketInfo);
192188
} catch (IOException ex) {
193189
exception = ex;
194190
omClientResponse = prepareCreateKeyResponse(keyArgs, omKeyInfo, locations,
195191
encryptionInfo.orNull(), exception, createKeyRequest.getClientID(),
196192
transactionLogIndex, volumeName, bucketName, keyName, ozoneManager,
197-
OMAction.ALLOCATE_KEY);
193+
OMAction.ALLOCATE_KEY, ozoneManager.getPrefixManager(), null);
198194
} finally {
199195
if (omClientResponse != null) {
200196
omClientResponse.setFlushFuture(

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,6 @@
4343
.DeleteKeyResponse;
4444
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
4545
.OMRequest;
46-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
47-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
4846
import org.apache.hadoop.util.Time;
4947
import org.apache.hadoop.utils.db.cache.CacheKey;
5048
import org.apache.hadoop.utils.db.cache.CacheValue;
@@ -111,11 +109,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
111109
OMClientResponse omClientResponse = null;
112110
try {
113111
// check Acl
114-
if (ozoneManager.getAclsEnabled()) {
115-
checkAcls(ozoneManager, OzoneObj.ResourceType.KEY,
116-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.DELETE,
117-
volumeName, bucketName, keyName);
118-
}
112+
checkKeyAcls(ozoneManager, volumeName, bucketName, keyName);
119113

120114
String objectKey = omMetadataManager.getOzoneKey(
121115
volumeName, bucketName, keyName);

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,6 @@
4444
.RenameKeyRequest;
4545
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos
4646
.RenameKeyResponse;
47-
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
48-
import org.apache.hadoop.ozone.security.acl.OzoneObj;
4947
import org.apache.hadoop.util.Time;
5048
import org.apache.hadoop.utils.db.Table;
5149
import org.apache.hadoop.utils.db.cache.CacheKey;
@@ -120,11 +118,7 @@ public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
120118
OMException.ResultCodes.INVALID_KEY_NAME);
121119
}
122120
// check Acl
123-
if (ozoneManager.getAclsEnabled()) {
124-
checkAcls(ozoneManager, OzoneObj.ResourceType.KEY,
125-
OzoneObj.StoreType.OZONE, IAccessAuthorizer.ACLType.WRITE,
126-
volumeName, bucketName, fromKeyName);
127-
}
121+
checkKeyAcls(ozoneManager, volumeName, bucketName, fromKeyName);
128122

129123
acquiredLock = omMetadataManager.getLock().acquireLock(BUCKET_LOCK,
130124
volumeName, bucketName);

0 commit comments

Comments
 (0)