[AMBARI-24228] Agent-side command-*.json files should optionally be deleted when no longer needed by the command

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.7.0
• Component/s: ambari-agent
• Labels: pull-request-available
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 29/Jun/18 20:31
• Updated: 31/Aug/18 12:12
• Resolved: 01/Jul/18 12:28

Description

Agent-side command JSON files (command-*.json, status_command.json) should optionally be deleted when no longer needed by the command. One reason for this is to reduce the risk of leaking sensitive data stored at plaintext in the command JSON files.

Currently the command JSON files are stored on disk in /var/lib/ambari-agent/data. These files may be cleared out over time, but there is a need to have them removed as soon as they are no longer needed.

To do this, a retention policy may be defined so that the Ambari agent behaves accordingly:

• keep
  • No automatic removal is performed
  • This is the default behavior
• remove
  • The command JSON file are removed as soon as the command completes
• remove_on_success
  • The command JSON files are removed as soon as the command successfully completes
  • The command JSON files are not removed on failure conditions

This value is to be set in the ambari-agent.ini file, typically found at /etc/ambari-agent/conf/ambari-agent.ini using the command_file_retention_policy property. After setting this property, the agent needs to be restarted.

Issue Links

• links to: GitHub Pull Request #1652