[YARN-3100] Make YARN authorization pluggable

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.7.0
• Hadoop Flags: Reviewed
• Assignee: Jian He
• Reporter: Jian He
• Created: 27/Jan/15 00:34
• Updated: 24/Apr/15 23:17
• Resolved: 10/Feb/15 04:39

Description

The goal is to have YARN acl model pluggable so as to integrate other authorization tool such as Apache Ranger, Sentry.

Currently, we have

• admin ACL
• queue ACL
• application ACL
• time line domain ACL
• service ACL

The proposal is to create a YarnAuthorizationProvider interface. Current implementation will be the default implementation. Ranger or Sentry plug-in can implement this interface.

Benefit:

• Unify the code base. With the default implementation, we can get rid of each specific ACL manager such as AdminAclManager, ApplicationACLsManager, QueueAclsManager etc.
• Enable Ranger, Sentry to do authorization for YARN.

Issue Links

• is related to: HADOOP-4348 Adding service-level authorization to Hadoop
• is related to: HDFS-6826 Plugin interface to enable delegation of HDFS authorization assertions
• is related to: YARN-3162 persistence support for YarnAuthorizationProvider