Examples with ContainerTokenIdentifier org.apache.hadoop.yarn.security.ContainerTokenIdentifier used on opensource projects

Example 21 with ContainerTokenIdentifier

use of org.apache.hadoop.yarn.security.ContainerTokenIdentifier in project hadoop by apache.

the class TestRPC method test.

private void test(String rpcClass) throws Exception {
    Configuration conf = new Configuration();
    conf.set(YarnConfiguration.IPC_RPC_IMPL, rpcClass);
    YarnRPC rpc = YarnRPC.create(conf);
    String bindAddr = "localhost:0";
    InetSocketAddress addr = NetUtils.createSocketAddr(bindAddr);
    Server server = rpc.getServer(ContainerManagementProtocol.class, new DummyContainerManager(), addr, conf, null, 1);
    server.start();
    RPC.setProtocolEngine(conf, ContainerManagementProtocolPB.class, ProtobufRpcEngine.class);
    ContainerManagementProtocol proxy = (ContainerManagementProtocol) rpc.getProxy(ContainerManagementProtocol.class, NetUtils.getConnectAddress(server), conf);
    ContainerLaunchContext containerLaunchContext = RECORD_FACTORY.newRecordInstance(ContainerLaunchContext.class);
    ApplicationId applicationId = ApplicationId.newInstance(0, 0);
    ApplicationAttemptId applicationAttemptId = ApplicationAttemptId.newInstance(applicationId, 0);
    ContainerId containerId = ContainerId.newContainerId(applicationAttemptId, 100);
    NodeId nodeId = NodeId.newInstance("localhost", 1234);
    Resource resource = Resource.newInstance(1234, 2);
    ContainerTokenIdentifier containerTokenIdentifier = new ContainerTokenIdentifier(containerId, "localhost", "user", resource, System.currentTimeMillis() + 10000, 42, 42, Priority.newInstance(0), 0);
    Token containerToken = newContainerToken(nodeId, "password".getBytes(), containerTokenIdentifier);
    StartContainerRequest scRequest = StartContainerRequest.newInstance(containerLaunchContext, containerToken);
    List<StartContainerRequest> list = new ArrayList<StartContainerRequest>();
    list.add(scRequest);
    StartContainersRequest allRequests = StartContainersRequest.newInstance(list);
    proxy.startContainers(allRequests);
    List<ContainerId> containerIds = new ArrayList<ContainerId>();
    containerIds.add(containerId);
    GetContainerStatusesRequest gcsRequest = GetContainerStatusesRequest.newInstance(containerIds);
    GetContainerStatusesResponse response = proxy.getContainerStatuses(gcsRequest);
    List<ContainerStatus> statuses = response.getContainerStatuses();
    //test remote exception
    boolean exception = false;
    try {
        StopContainersRequest stopRequest = RECORD_FACTORY.newRecordInstance(StopContainersRequest.class);
        stopRequest.setContainerIds(containerIds);
        proxy.stopContainers(stopRequest);
    } catch (YarnException e) {
        exception = true;
        Assert.assertTrue(e.getMessage().contains(EXCEPTION_MSG));
        Assert.assertTrue(e.getMessage().contains(EXCEPTION_CAUSE));
        System.out.println("Test Exception is " + e.getMessage());
    } catch (Exception ex) {
        ex.printStackTrace();
    } finally {
        server.stop();
    }
    Assert.assertTrue(exception);
    Assert.assertNotNull(statuses.get(0));
    Assert.assertEquals(ContainerState.RUNNING, statuses.get(0).getState());
}

Example 22 with ContainerTokenIdentifier

use of org.apache.hadoop.yarn.security.ContainerTokenIdentifier in project hadoop by apache.

the class OpportunisticContainerAllocator method createContainer.

private Container createContainer(long rmIdentifier, long tokenExpiry, SchedulerRequestKey schedulerKey, String userName, RemoteNode node, ContainerId cId, Resource capability) {
    long currTime = System.currentTimeMillis();
    ContainerTokenIdentifier containerTokenIdentifier = new ContainerTokenIdentifier(cId, 0, node.getNodeId().toString(), userName, capability, currTime + tokenExpiry, tokenSecretManager.getCurrentKey().getKeyId(), rmIdentifier, schedulerKey.getPriority(), currTime, null, CommonNodeLabelsManager.NO_LABEL, ContainerType.TASK, ExecutionType.OPPORTUNISTIC);
    byte[] pwd = tokenSecretManager.createPassword(containerTokenIdentifier);
    Token containerToken = newContainerToken(node.getNodeId(), pwd, containerTokenIdentifier);
    Container container = BuilderUtils.newContainer(cId, node.getNodeId(), node.getHttpAddress(), capability, schedulerKey.getPriority(), containerToken, containerTokenIdentifier.getExecutionType(), schedulerKey.getAllocationRequestId());
    return container;
}

Example 23 with ContainerTokenIdentifier

use of org.apache.hadoop.yarn.security.ContainerTokenIdentifier in project hadoop by apache.

the class ContainerManagerImpl method recoverContainer.

private void recoverContainer(RecoveredContainerState rcs) throws IOException {
    StartContainerRequest req = rcs.getStartRequest();
    ContainerLaunchContext launchContext = req.getContainerLaunchContext();
    ContainerTokenIdentifier token = BuilderUtils.newContainerTokenIdentifier(req.getContainerToken());
    ContainerId containerId = token.getContainerID();
    ApplicationId appId = containerId.getApplicationAttemptId().getApplicationId();
    LOG.info("Recovering " + containerId + " in state " + rcs.getStatus() + " with exit code " + rcs.getExitCode());
    Application app = context.getApplications().get(appId);
    if (app != null) {
        recoverActiveContainer(app, launchContext, token, rcs);
        if (rcs.getRecoveryType() == RecoveredContainerType.KILL) {
            dispatcher.getEventHandler().handle(new ContainerKillEvent(containerId, ContainerExitStatus.ABORTED, "Due to invalid StateStore info container was killed" + " during recovery"));
        }
    } else {
        if (rcs.getStatus() != RecoveredContainerStatus.COMPLETED) {
            LOG.warn(containerId + " has no corresponding application!");
        }
        LOG.info("Adding " + containerId + " to recently stopped containers");
        nodeStatusUpdater.addCompletedContainer(containerId);
    }
}

Example 24 with ContainerTokenIdentifier

use of org.apache.hadoop.yarn.security.ContainerTokenIdentifier in project hadoop by apache.

the class AMRMProxyService method processApplicationStartRequest.

/**
   * Callback from the ContainerManager implementation for initializing the
   * application request processing pipeline.
   *
   * @param request - encapsulates information for starting an AM
   * @throws IOException
   * @throws YarnException
   */
public void processApplicationStartRequest(StartContainerRequest request) throws IOException, YarnException {
    LOG.info("Callback received for initializing request " + "processing pipeline for an AM");
    ContainerTokenIdentifier containerTokenIdentifierForKey = BuilderUtils.newContainerTokenIdentifier(request.getContainerToken());
    ApplicationAttemptId appAttemptId = containerTokenIdentifierForKey.getContainerID().getApplicationAttemptId();
    Credentials credentials = YarnServerSecurityUtils.parseCredentials(request.getContainerLaunchContext());
    Token<AMRMTokenIdentifier> amrmToken = getFirstAMRMToken(credentials.getAllTokens());
    if (amrmToken == null) {
        throw new YarnRuntimeException("AMRMToken not found in the start container request for application:" + appAttemptId.toString());
    }
    // Substitute the existing AMRM Token with a local one. Keep the rest of the
    // tokens in the credentials intact.
    Token<AMRMTokenIdentifier> localToken = this.secretManager.createAndGetAMRMToken(appAttemptId);
    credentials.addToken(localToken.getService(), localToken);
    DataOutputBuffer dob = new DataOutputBuffer();
    credentials.writeTokenStorageToStream(dob);
    request.getContainerLaunchContext().setTokens(ByteBuffer.wrap(dob.getData(), 0, dob.getLength()));
    initializePipeline(containerTokenIdentifierForKey.getContainerID().getApplicationAttemptId(), containerTokenIdentifierForKey.getApplicationSubmitter(), amrmToken, localToken);
}

Example 25 with ContainerTokenIdentifier

use of org.apache.hadoop.yarn.security.ContainerTokenIdentifier in project hadoop by apache.

the class ContainerManagerImpl method startContainers.

/**
   * Start a list of containers on this NodeManager.
   */
@Override
public StartContainersResponse startContainers(StartContainersRequest requests) throws YarnException, IOException {
    if (blockNewContainerRequests.get()) {
        throw new NMNotYetReadyException("Rejecting new containers as NodeManager has not" + " yet connected with ResourceManager");
    }
    UserGroupInformation remoteUgi = getRemoteUgi();
    NMTokenIdentifier nmTokenIdentifier = selectNMTokenIdentifier(remoteUgi);
    authorizeUser(remoteUgi, nmTokenIdentifier);
    List<ContainerId> succeededContainers = new ArrayList<ContainerId>();
    Map<ContainerId, SerializedException> failedContainers = new HashMap<ContainerId, SerializedException>();
    // been added to the containers map in NMContext.
    synchronized (this.context) {
        for (StartContainerRequest request : requests.getStartContainerRequests()) {
            ContainerId containerId = null;
            try {
                if (request.getContainerToken() == null || request.getContainerToken().getIdentifier() == null) {
                    throw new IOException(INVALID_CONTAINERTOKEN_MSG);
                }
                ContainerTokenIdentifier containerTokenIdentifier = BuilderUtils.newContainerTokenIdentifier(request.getContainerToken());
                verifyAndGetContainerTokenIdentifier(request.getContainerToken(), containerTokenIdentifier);
                containerId = containerTokenIdentifier.getContainerID();
                // type AM and if the AMRMProxy service is enabled
                if (amrmProxyEnabled && containerTokenIdentifier.getContainerType().equals(ContainerType.APPLICATION_MASTER)) {
                    this.getAMRMProxyService().processApplicationStartRequest(request);
                }
                performContainerPreStartChecks(nmTokenIdentifier, request, containerTokenIdentifier);
                startContainerInternal(containerTokenIdentifier, request);
                succeededContainers.add(containerId);
            } catch (YarnException e) {
                failedContainers.put(containerId, SerializedException.newInstance(e));
            } catch (InvalidToken ie) {
                failedContainers.put(containerId, SerializedException.newInstance(ie));
                throw ie;
            } catch (IOException e) {
                throw RPCUtil.getRemoteException(e);
            }
        }
        return StartContainersResponse.newInstance(getAuxServiceMetaData(), succeededContainers, failedContainers);
    }
}