org.apache.hadoop.yarn.server.security

Class BaseContainerTokenSecretManager

java.lang.Object

org.apache.hadoop.security.token.SecretManager<ContainerTokenIdentifier>

org.apache.hadoop.yarn.server.security.BaseContainerTokenSecretManager

Direct Known Subclasses:

NMContainerTokenSecretManager, RMContainerTokenSecretManager

public class BaseContainerTokenSecretManager
extends SecretManager<ContainerTokenIdentifier>

SecretManager for ContainerTokens. Extended by both RM and NM and hence is present in yarn-server-common package.

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.hadoop.security.token.SecretManager

SecretManager.InvalidToken

Field Summary

Fields

Modifier and Type	Field and Description
protected long	containerTokenExpiryInterval
protected MasterKeyData	currentMasterKey THE masterKey.
protected Lock	readLock
protected ReadWriteLock	readWriteLock
protected Lock	writeLock

Constructor Summary

Constructors

Constructor and Description
BaseContainerTokenSecretManager(Configuration conf)

Method Summary

Methods

Modifier and Type	Method and Description
ContainerTokenIdentifier	createIdentifier() Used by the RPC layer.
protected MasterKeyData	createNewMasterKey()
byte[]	createPassword(ContainerTokenIdentifier identifier) Create the password for the given identifier.
MasterKey	getCurrentKey()
byte[]	retrievePassword(ContainerTokenIdentifier identifier) Retrieve the password for the given token identifier.
protected byte[]	retrievePasswordInternal(ContainerTokenIdentifier identifier, MasterKeyData masterKey)

Methods inherited from class org.apache.hadoop.security.token.SecretManager

checkAvailableForRead, createPassword, createSecretKey, generateSecret

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

readWriteLock

protected final ReadWriteLock readWriteLock

readLock

protected final Lock readLock

writeLock

protected final Lock writeLock

currentMasterKey

protected MasterKeyData currentMasterKey

THE masterKey. ResourceManager should persist this and recover it on restart instead of generating a new key. The NodeManagers get it from the ResourceManager and use it for validating container-tokens.

containerTokenExpiryInterval

protected final long containerTokenExpiryInterval

Constructor Detail

BaseContainerTokenSecretManager

public BaseContainerTokenSecretManager(Configuration conf)

Method Detail

createNewMasterKey

protected MasterKeyData createNewMasterKey()

getCurrentKey

@InterfaceAudience.Private
public MasterKey getCurrentKey()

createPassword

public byte[] createPassword(ContainerTokenIdentifier identifier)

Description copied from class: SecretManager

Create the password for the given identifier. identifier may be modified inside this method.

Specified by:

createPassword in class SecretManager<ContainerTokenIdentifier>

Parameters:

identifier - the identifier to use

Returns:

the new password

retrievePassword

public byte[] retrievePassword(ContainerTokenIdentifier identifier)
                        throws SecretManager.InvalidToken

Description copied from class: SecretManager

Retrieve the password for the given token identifier. Should check the date or registry to make sure the token hasn't expired or been revoked. Returns the relevant password.

Specified by:

retrievePassword in class SecretManager<ContainerTokenIdentifier>

Parameters:

identifier - the identifier to validate

Returns:

the password to use

Throws:

SecretManager.InvalidToken - the token was invalid

retrievePasswordInternal

protected byte[] retrievePasswordInternal(ContainerTokenIdentifier identifier,
                              MasterKeyData masterKey)
                                   throws SecretManager.InvalidToken

Throws:

SecretManager.InvalidToken

createIdentifier

public ContainerTokenIdentifier createIdentifier()

Used by the RPC layer.

Specified by:

createIdentifier in class SecretManager<ContainerTokenIdentifier>

Returns:

the newly created empty token identifier