[MESOS-10099] Operator API can silently drop objects due to authorization errors.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: master
• Assignee: Andrei Sekretenko
• Reporter: Andrei Sekretenko
• Created: 27/Feb/20 15:13
• Updated: 27/Feb/20 15:14

Description

Currently, `ObjectApproves` does not discern declined authorization from error returned by `ObjectApprovers::approved()`:

https://github.com/apache/mesos/blob/e3db054d639b79a7b0246d2431ff8eece3e394e8/src/master/master.cpp#L13274

As a consequence, authorization errors in ObjectApprover result in silently filtering objects in operator API calls, example: https://github.com/apache/mesos/blob/998aee66bfedd1fe15bb1e1fc43a637fe91662a5/src/master/readonly_handler.cpp#L196

This issue is potentially exacerbated by introduction of synchronous authorization (which will result in transient failures propagated as errors returned by `approved(...)`.

Issue Links

• is related to: MESOS-10085 Operator API events are silently dropped on transient authorization failures.
• is related to: MESOS-10056 Perform synchronous authorization for scheduler calls.