[IMPALA-6493] ACLs on admission control pool not respected

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Not A Bug
• Affects Version/s: Impala 2.11.0
• Component/s: Security
• Labels: admission-control resource-management
• Environment: Impala 2.11
• Target Version: Impala 2.12.0
• Epic Color: ghx-label-6
• Assignee: Tim Armstrong
• Reporter: Matthew Jacobs
• Created: 08/Feb/18 18:25
• Updated: 06/Mar/18 01:23
• Resolved: 06/Mar/18 01:23

Description

A user reported that ACLs set on an admission control pool weren't respected.

The configuration is:

 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<allocations>
<queue name="root">
<weight>1.0</weight>
<schedulingPolicy>fair</schedulingPolicy>
<queue name="impiaas">
<weight>1.0</weight>
<schedulingPolicy>fair</schedulingPolicy>
<aclSubmitApps>fawzea </aclSubmitApps>
</queue>
<queue name="impreports">
<weight>1.0</weight>
<schedulingPolicy>fair</schedulingPolicy>
<aclSubmitApps>nira </aclSubmitApps>
</queue>
</queue>
<defaultQueueSchedulingPolicy>fair</defaultQueueSchedulingPolicy>
<queuePlacementPolicy>
<rule name="specified" create="false"/>
<rule name="secondaryGroupExistingQueue"/>
<rule name="default"/>
</queuePlacementPolicy>
</allocations>

Relevant profile and log snippets:

  Summary:
    ...
    Query Type: QUERY
    Query State: FINISHED
    Query Status: OK
    Impala Version: impalad version 2.11.0-cdh5.14.0 RELEASE (build d68206561bce6b26762d62c01a78e6cd27aa7690)
    User: fawzea
    Connected User: fawzea
    Delegated User:
    ...
    Query Options (set by configuration): REQUEST_POOL=impreports
    Query Options (set by configuration and planner): REQUEST_POOL=impreports,MT_DOP=0
    Request Pool: root.impreports
    Admission result: Admitted immediately

===================================================
...

 01: query (string) = "select count(*) from dv_entersiteevent_prq_remote where year=2017 and month=10",
  03: configuration (list) = list<string>[1] {
    [0] = "REQUEST_POOL=impreports",
  },
  04: hadoop_user (string) = "fawzea",
}
I0208 01:07:06.321281  7154 impala-beeswax-server.cc:459] TClientRequest.queryOptions: TQueryOptions {
  20: request_pool (string) = "impreports",
}
I0208 01:07:06.324410  7154 Frontend.java:909] Compiling query: select count(*) from dv_entersiteevent_prq_remote where year=2017 and month=10
I0208 01:07:06.327203  7154 Frontend.java:948] Compiled query.
I0208 01:07:06.359748  7154 admission-controller.cc:510] Schedule for id=5f49e927591a9042:faf8f28600000000 in pool_name=root.impreports cluster_mem_needed=105.00 MB PoolConfig: max_requests=-1 max_queued=200 max_mem=-1.00 B
I0208 01:07:06.359776  7154 admission-controller.cc:515] Stats: agg_num_running=0, agg_num_queued=0, agg_mem_reserved=0,  local_host(local_mem_admitted=0, num_admitted_running=0, num_queued=0, backend_mem_reserved=0)
I0208 01:07:06.359784  7154 admission-controller.cc:531] Admitted query id=5f49e927591a9042:faf8f28600000000

I suspect IMPALA-5920.

The user has LDAP, I'm not sure if that's relevant but the tests do not cover LDAP. The user reported that the issue occurs regardless of whether the secondaryGroupExistingQueue is specified.