[MESOS-5757] Authorize orphaned tasks

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.0.0
• Component/s: security
• Labels: mesosphere security
• Epic Link: Authorize operator endpoints
• Sprint: Mesosphere Sprint 38
• Assignee: Jörg Schad
• Reporter: Vinod Kone
• Shepherd: Vinod Kone
• Created: 01/Jul/16 00:39
• Updated: 29/Apr/19 09:27
• Resolved: 05/Jul/16 22:06

Description

Currently, orphaned tasks are not filtered (i.e., using authorization) when a request is made to /state endpoint. This is inconsistent (and unexpected) with how we filter un-orphaned tasks.

This is tricky because master and hence the authorizer do not have FrameworkInfos for these orphaned tasks, until after the corresponding frameworks re-register.

One option is for the agent to include FrameworkInfos of all its tasks and executors in its re-registration message.

Issue Links

• is related to: MESOS-5761 Improve the logic of orphan tasks