[MESOS-8774] Authenticate and authorize calls to the resource provider manager's API

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.7.0
• Component/s: agent
• Labels: mesosphere
• Epic Link: Resource Provider and CSI Tech Debt
• Sprint: Mesosphere Sprint 79
• Story Points: 8
• Assignee: Jan Schlicht
• Reporter: Benjamin Bannier
• Shepherd: Benjamin Bannier
• Created: 11/Apr/18 11:35
• Updated: 21/Aug/18 16:51
• Resolved: 09/May/18 11:35

Description

The resource provider manager is exposed via an agent endpoint against which resource providers subscribe or perform other actions. We should authenticate and authorize any interactions there.

Since currently local resource providers run on agents who manages their lifetime it seems natural to extend the framework used for executor authentication to resource providers as well. The agent would then generate a secret token whenever a new resource provider is started and inject it into the resource providers it launches. Resource providers in turn would use this token when interacting with the manager API.

Issue Links

• duplicates: MESOS-7854 Authorize resource calls to provider manager api