[MESOS-7415] Add authorization to master's operator maintenance API in v0 and v1

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Component/s: c++ api, HTTP API, master
• Labels: authorization mesosphere security
• Sprint: Mesosphere Sprint 56, Mesosphere Sprint 57, Mesosphere Sprint 58
• Story Points: 3
• Assignee: Alexander Rojas
• Reporter: Alexander Rojas
• Shepherd: Till Toenshoff
• Created: 24/Apr/17 13:08
• Updated: 16/Jun/17 19:37
• Resolved: 16/Jun/17 19:37

Description

None of the maintenance primitives in either API v0 or API v1 have any kind of authorization, which allows any user with valid credentials to do things such as shutting down a machine, schedule time off on an agent, modify maintenance schedule, etc.

The authorization support needs to be added to the v0 endpoints:

• /master/machine/up
• /master/machine/down
• /master/maintenance/schedule
• /master/maintenance/status

as well as to the v1 calls:

• GET_MAINTENANCE_STATUS
• GET_MAINTENANCE_SCHEDULE
• UPDATE_MAINTENANCE_SCHEDULE
• START_MAINTENANCE
• STOP_MAINTENANCE

Issue Links

• Blocked: MESOS-2222 Add ACLs for the maintenance HTTP endpoints.