[OOZIE-2897] LauncherAM should support ACLs

• Type: Sub-task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 5.0.0
• Fix Version/s: 5.0.0b1
• Assignee: Peter Bacsko
• Reporter: Peter Bacsko
• Created: 15/May/17 12:06
• Updated: 25/Jan/18 21:00
• Resolved: 07/Nov/17 16:44

Description

In MapReduce, you can define ACL-related properties:

mapreduce.job.acl-view-job
mapreduce.job.acl-modify-job

acl-view-job defines a list of users/groups who can retrieve the job statistics. acl-modify-job defines a list of users/groups who can kill a job or adjust the priority of it.
Docs: https://hadoop.apache.org/docs/r1.2.1/mapred_tutorial.html#Job+Authorization

In YARN, we can provide backward compatibility for these properties. Example code:

Map<ApplicationAccessType, String> acls = new HashMap<ApplicationAccessType, String>();
acls.put(ApplicationAccessType.MODIFY_APP, "*");
acls.put(ApplicationAccessType.VIEW_APP, "*");
amContainer.setApplicationACLs(acls);

This has to be done before application submission. We have to do what YARNRunner.java does: https://github.com/apache/hadoop/blob/3721cfe1fbd98c5b6aa46aefdfcf62276c28c4a4/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/src/main/java/org/apache/hadoop/mapred/YARNRunner.java#L502-L507

We should also ensure the compatibility with the properties of:
mapreduce.job.acl-view-job
mapreduce.job.acl-modfy-job

Issue Links

• is related to: OOZIE-3099 Implement the equivalent of mapreduce.job.acl-view-job and mapreduce.job.acl-modify-job
• links to: Review