blob: 562449bb47a00ec44b2afc35d7030a4d4a04b99d [file] [log] [blame]
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements. See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership. The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License. You may obtain a copy of the License at
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// See the License for the specific language governing permissions and
// limitations under the License.
#include <ostream>
#include <string>
#include <vector>
#include <stout/option.hpp>
#include <stout/try.hpp>
#include <mesos/mesos.hpp>
#include <mesos/resources.hpp>
#include <mesos/authorizer/authorizer.pb.h>
namespace mesos {
namespace authorization {
class ActionObject
Action action() const { return action_; }
const Option<Object>& object() const& { return object_; }
Option<Object>&& object() && { return std::move(object_); }
// Returns action-object pair for authorizing a task launch.
static ActionObject taskLaunch(
const TaskInfo& task,
const FrameworkInfo& framework);
// Returns action-object pair for authorizing
// framework (re)registration or update.
static ActionObject frameworkRegistration(
const FrameworkInfo& frameworkInfo);
// Returns action-object pair(s) for authorizing agent re(registration).
static std::vector<ActionObject> agentRegistration(
const SlaveInfo& slaveInfo);
// Methods that return action-object pair(s) for authorizing
// offer operations other than LAUNCH/LAUNCH_GROUP.
// NOTE: these methods rely on the caller to ensure that operation
// resources are in post-reservation-refinement format.
// Otherwise, they may crash the program.
static std::vector<ActionObject> unreserve(
const Offer::Operation::Unreserve& unreserve);
static std::vector<ActionObject> reserve(
const Offer::Operation::Reserve& reserve);
static std::vector<ActionObject> createVolume(
const Offer::Operation::Create& create);
static std::vector<ActionObject> destroyVolume(
const Offer::Operation::Destroy& destroy);
static ActionObject growVolume(
const Offer::Operation::GrowVolume& grow);
static ActionObject shrinkVolume(
const Offer::Operation::ShrinkVolume& shrink);
// Returns Error if disk type is not supported.
// TODO(asekretenko): Change return type to ActionObject after
// authorization of invalid operations no longer occurs (see MESOS-10083).
static Try<ActionObject> createDisk(
const Offer::Operation::CreateDisk& createDisk);
// Returns Error if disk type is not supported.
// TODO(asekretenko): Change return type to ActionObject after
// authorization of invalid operations no longer occurs (see MESOS-10083).
static Try<ActionObject> destroyDisk(
const Offer::Operation::DestroyDisk& destroyDisk);
Action action_;
Option<Object> object_;
ActionObject(Action action, Option<Object>&& object)
: action_(action), object_(object){};
// Returns an action-object pair for the case that commonly
// occurs when authorizing non-LAUNCH operations: sets `action`,
// `object.resource` and `object.value`.
// NOTE: the deprecated `object.value` field is set to support legacy
// authorizers that have not been upgraded to look at `object.resource`.
static ActionObject fromResourceWithLegacyValue(
Action action,
const Resource& resource,
std::string value_);
// Helper method for `reserve()`/`unreserve()`.
// For each resource reserved with a principal, pushes into `result` an
// ActionObject needed for unreserving it. If there are resources reserved
// without a principal, an UNRESERVE_RESOURCE for ANY object is also added
// (see MESOS-9562).
// NOTE: Since the UNRESERVE operation only "pops" one reservation off the
// stack of reservations, only principals of the most refined reservations
// (i.e. ones that will be unreserved) are used.
// NOTE: Currently, validation of RESERVE operations prevents creating
// reservation without a principal, so they should not exist in new
// clusters.
static void pushUnreserveActionObjects(
const Resources& resources,
std::vector<ActionObject>* result);
// Outputs human-readable description of an ActionObject.
// NOTE: For more convenient use in authorization-related messages
// ("Authorizing principal 'baz' to launch task", "Forbidden to create disk...",
// and so on), the description starts with a verb.
// Output examples:
// - "launch task 123 of framework de-adbe-ef",
// - "perform action FOO_BAR on object '{task_info: ..., machine_id: ...}"
std::ostream& operator<<(
std::ostream& stream,
const ActionObject& actionObject);
} // namespace authorization {
} // namespace mesos {