Java NMTokenIdentifier类代码示例

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
@Override
protected byte[] createPassword(NMTokenIdentifier identifier) {
  if (LOG.isDebugEnabled()) {
    LOG.debug("creating password for "
        + identifier.getApplicationAttemptId() + " for user "
        + identifier.getApplicationSubmitter() + " to run on NM "
        + identifier.getNodeId());
  }
  readLock.lock();
  try {
    return createPassword(identifier.getBytes(),
        currentMasterKey.getSecretKey());
  } finally {
    readLock.unlock();
  }
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
/**
 * Stop a list of containers running on this NodeManager.
 */
@Override
public StopContainersResponse stopContainers(StopContainersRequest requests)
    throws YarnException, IOException {

  List<ContainerId> succeededRequests = new ArrayList<ContainerId>();
  Map<ContainerId, SerializedException> failedRequests =
      new HashMap<ContainerId, SerializedException>();
  UserGroupInformation remoteUgi = getRemoteUgi();
  NMTokenIdentifier identifier = selectNMTokenIdentifier(remoteUgi);
  for (ContainerId id : requests.getContainerIds()) {
    try {
      stopContainerInternal(identifier, id);
      succeededRequests.add(id);
    } catch (YarnException e) {
      failedRequests.put(id, SerializedException.newInstance(e));
    }
  }
  return StopContainersResponse
    .newInstance(succeededRequests, failedRequests);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
/**
 * Get a list of container statuses running on this NodeManager
 */
@Override
public GetContainerStatusesResponse getContainerStatuses(
    GetContainerStatusesRequest request) throws YarnException, IOException {

  List<ContainerStatus> succeededRequests = new ArrayList<ContainerStatus>();
  Map<ContainerId, SerializedException> failedRequests =
      new HashMap<ContainerId, SerializedException>();
  UserGroupInformation remoteUgi = getRemoteUgi();
  NMTokenIdentifier identifier = selectNMTokenIdentifier(remoteUgi);
  for (ContainerId id : request.getContainerIds()) {
    try {
      ContainerStatus status = getContainerStatusInternal(id, identifier);
      succeededRequests.add(status);
    } catch (YarnException e) {
      failedRequests.put(id, SerializedException.newInstance(e));
    }
  }
  return GetContainerStatusesResponse.newInstance(succeededRequests,
    failedRequests);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private ContainerStatus getContainerStatusInternal(ContainerId containerID,
    NMTokenIdentifier nmTokenIdentifier) throws YarnException {
  String containerIDStr = containerID.toString();
  Container container = this.context.getContainers().get(containerID);

  LOG.info("Getting container-status for " + containerIDStr);
  authorizeGetAndStopContainerRequest(containerID, container, false,
    nmTokenIdentifier);

  if (container == null) {
    if (nodeStatusUpdater.isContainerRecentlyStopped(containerID)) {
      throw RPCUtil.getRemoteException("Container " + containerIDStr
        + " was recently stopped on node manager.");
    } else {
      throw RPCUtil.getRemoteException("Container " + containerIDStr
        + " is not handled by this NodeManager");
    }
  }
  ContainerStatus containerStatus = container.cloneAndGetContainerStatus();
  LOG.info("Returning " + containerStatus);
  return containerStatus;
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private StartContainersResponse startContainer(Context context,
    final ContainerManagerImpl cm, ContainerId cid,
    ContainerLaunchContext clc, LogAggregationContext logAggregationContext)
        throws Exception {
  UserGroupInformation user = UserGroupInformation.createRemoteUser(
      cid.getApplicationAttemptId().toString());
  StartContainerRequest scReq = StartContainerRequest.newInstance(
      clc, TestContainerManager.createContainerToken(cid, 0,
          context.getNodeId(), user.getShortUserName(),
          context.getContainerTokenSecretManager(), logAggregationContext));
  final List<StartContainerRequest> scReqList =
      new ArrayList<StartContainerRequest>();
  scReqList.add(scReq);
  NMTokenIdentifier nmToken = new NMTokenIdentifier(
      cid.getApplicationAttemptId(), context.getNodeId(),
      user.getShortUserName(),
      context.getNMTokenSecretManager().getCurrentKey().getKeyId());
  user.addTokenIdentifier(nmToken);
  return user.doAs(new PrivilegedExceptionAction<StartContainersResponse>() {
    @Override
    public StartContainersResponse run() throws Exception {
      return cm.startContainers(
          StartContainersRequest.newInstance(scReqList));
    }
  });
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
@Private
@VisibleForTesting
protected ContainerManagementProtocol newProxy(final YarnRPC rpc,
    String containerManagerBindAddr, ContainerId containerId, Token token)
    throws InvalidToken {

  if (token == null) {
    throw new InvalidToken("No NMToken sent for "
        + containerManagerBindAddr);
  }
  
  final InetSocketAddress cmAddr =
      NetUtils.createSocketAddr(containerManagerBindAddr);
  LOG.info("Opening proxy : " + containerManagerBindAddr);
  // the user in createRemoteUser in this context has to be ContainerID
  UserGroupInformation user =
      UserGroupInformation.createRemoteUser(containerId
          .getApplicationAttemptId().toString());

  org.apache.hadoop.security.token.Token<NMTokenIdentifier> nmToken =
      ConverterUtils.convertFromYarn(token, cmAddr);
  user.addToken(nmToken);

  return NMProxy.createNMProxy(conf, ContainerManagementProtocol.class,
    user, rpc, cmAddr);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
/**
 * Stop a list of containers running on this NodeManager.
 */
@Override
public StopContainersResponse stopContainers(StopContainersRequest requests)
    throws YarnException, IOException {

  List<ContainerId> succeededRequests = new ArrayList<ContainerId>();
  Map<ContainerId, SerializedException> failedRequests =
      new HashMap<ContainerId, SerializedException>();
  UserGroupInformation remoteUgi = getRemoteUgi();
  NMTokenIdentifier identifier = selectNMTokenIdentifier(remoteUgi);
  if (identifier == null) {
    throw RPCUtil.getRemoteException(INVALID_NMTOKEN_MSG);
  }
  for (ContainerId id : requests.getContainerIds()) {
    try {
      stopContainerInternal(identifier, id);
      succeededRequests.add(id);
    } catch (YarnException e) {
      failedRequests.put(id, SerializedException.newInstance(e));
    }
  }
  return StopContainersResponse
    .newInstance(succeededRequests, failedRequests);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
/**
 * Get a list of container statuses running on this NodeManager
 */
@Override
public GetContainerStatusesResponse getContainerStatuses(
    GetContainerStatusesRequest request) throws YarnException, IOException {

  List<ContainerStatus> succeededRequests = new ArrayList<ContainerStatus>();
  Map<ContainerId, SerializedException> failedRequests =
      new HashMap<ContainerId, SerializedException>();
  UserGroupInformation remoteUgi = getRemoteUgi();
  NMTokenIdentifier identifier = selectNMTokenIdentifier(remoteUgi);
  if (identifier == null) {
    throw RPCUtil.getRemoteException(INVALID_NMTOKEN_MSG);
  }
  for (ContainerId id : request.getContainerIds()) {
    try {
      ContainerStatus status = getContainerStatusInternal(id, identifier);
      succeededRequests.add(status);
    } catch (YarnException e) {
      failedRequests.put(id, SerializedException.newInstance(e));
    }
  }
  return GetContainerStatusesResponse.newInstance(succeededRequests,
    failedRequests);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private ContainerManagerImpl createContainerManager(Context context,
    DeletionService delSrvc) {
  return new ContainerManagerImpl(context, exec, delSrvc,
      mock(NodeStatusUpdater.class), metrics, dirsHandler) {
    @Override
    public void
    setBlockNewContainerRequests(boolean blockNewContainerRequests) {
      // do nothing
    }
    @Override
    protected void authorizeGetAndStopContainerRequest(
        ContainerId containerId, Container container,
        boolean stopRequest, NMTokenIdentifier identifier)
        throws YarnException {
      if(container == null || container.getUser().equals("Fail")){
        throw new YarnException("Reject this container");
      }
    }
  };
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private ContainerStatus getContainerStatus(
    Context context, final ContainerManagerImpl cm, ContainerId cid)
    throws  Exception {
  UserGroupInformation user = UserGroupInformation.createRemoteUser(
      cid.getApplicationAttemptId().toString());
  NMTokenIdentifier nmToken = new NMTokenIdentifier(
      cid.getApplicationAttemptId(), context.getNodeId(),
      user.getShortUserName(),
      context.getNMTokenSecretManager().getCurrentKey().getKeyId());
  user.addTokenIdentifier(nmToken);
  List<ContainerId> containerIds = new ArrayList<>();
  containerIds.add(cid);
  final GetContainerStatusesRequest gcsRequest =
      GetContainerStatusesRequest.newInstance(containerIds);
  return user.doAs(
      new PrivilegedExceptionAction<ContainerStatus>() {
        @Override
        public ContainerStatus run() throws Exception {
          return cm.getContainerStatuses(gcsRequest)
              .getContainerStatuses().get(0);
        }
      });
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private ContainerManagementProtocol getNMProxy() {
  ApplicationId appId = ApplicationId.newInstance(1, 1);
  ApplicationAttemptId attemptId = ApplicationAttemptId.newInstance(appId, 1);

  org.apache.hadoop.yarn.api.records.Token nmToken =
      context.getNMTokenSecretManager().createNMToken(attemptId,
          context.getNodeId(), user);
  final InetSocketAddress address =
      conf.getSocketAddr(YarnConfiguration.NM_BIND_HOST,
          YarnConfiguration.NM_ADDRESS, YarnConfiguration.DEFAULT_NM_ADDRESS,
          YarnConfiguration.DEFAULT_NM_PORT);
  Token<NMTokenIdentifier> token =
      ConverterUtils.convertFromYarn(nmToken,
          SecurityUtil.buildTokenService(address));
  UserGroupInformation ugi = UserGroupInformation.createRemoteUser(user);
  ugi.addToken(token);
  return NMProxy.createNMProxy(conf, ContainerManagementProtocol.class, ugi,
      YarnRPC.create(conf), address);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private void stopContainerInternal(NMTokenIdentifier nmTokenIdentifier,
    ContainerId containerID) throws YarnException {
  String containerIDStr = containerID.toString();
  Container container = this.context.getContainers().get(containerID);
  LOG.info("Stopping container with container Id: " + containerIDStr);
  authorizeGetAndStopContainerRequest(containerID, container, true,
    nmTokenIdentifier);

  dispatcher.getEventHandler().handle(
    new ContainerKillEvent(containerID,
      "Container killed by the ApplicationMaster."));

  NMAuditLogger.logSuccess(container.getUser(),
    AuditConstants.STOP_CONTAINER, "ContainerManageImpl", containerID
      .getApplicationAttemptId().getApplicationId(), containerID);

  // TODO: Move this code to appropriate place once kill_container is
  // implemented.
  nodeStatusUpdater.sendOutofBandHeartBeat();
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private StartContainersResponse startContainer(Context context,
    final ContainerManagerImpl cm, ContainerId cid,
    ContainerLaunchContext clc, LogAggregationContext logAggregationContext)
        throws Exception {
  UserGroupInformation user = UserGroupInformation.createRemoteUser(
      cid.getApplicationAttemptId().toString(), false);
  StartContainerRequest scReq = StartContainerRequest.newInstance(
      clc, TestContainerManager.createContainerToken(cid, 0,
          context.getNodeId(), user.getShortUserName(),
          context.getContainerTokenSecretManager(), logAggregationContext, user.getShortUserName() + "Folder"));
  final List<StartContainerRequest> scReqList =
      new ArrayList<StartContainerRequest>();
  scReqList.add(scReq);
  NMTokenIdentifier nmToken = new NMTokenIdentifier(
      cid.getApplicationAttemptId(), context.getNodeId(),
      user.getShortUserName(),
      context.getNMTokenSecretManager().getCurrentKey().getKeyId());
  user.addTokenIdentifier(nmToken);
  return user.doAs(new PrivilegedExceptionAction<StartContainersResponse>() {
    @Override
    public StartContainersResponse run() throws Exception {
      return cm.startContainers(
          StartContainersRequest.newInstance(scReqList));
    }
  });
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
private ContainerManagementProtocol getNMProxy(Configuration conf) {
  ApplicationId appId = ApplicationId.newInstance(1, 1);
  ApplicationAttemptId attemptId = ApplicationAttemptId.newInstance(appId, 1);

  org.apache.hadoop.yarn.api.records.Token nmToken =
      context.getNMTokenSecretManager().createNMToken(attemptId,
          context.getNodeId(), user);
  final InetSocketAddress address =
      conf.getSocketAddr(YarnConfiguration.NM_BIND_HOST,
          YarnConfiguration.NM_ADDRESS, YarnConfiguration.DEFAULT_NM_ADDRESS,
          YarnConfiguration.DEFAULT_NM_PORT);
  Token<NMTokenIdentifier> token =
      ConverterUtils.convertFromYarn(nmToken,
          SecurityUtil.buildTokenService(address));
  UserGroupInformation ugi = UserGroupInformation.createRemoteUser(user);
  ugi.addToken(token);
  return NMProxy.createNMProxy(conf, ContainerManagementProtocol.class, ugi,
      YarnRPC.create(conf), address);
}
 

import org.apache.hadoop.yarn.security.NMTokenIdentifier; //导入依赖的package包/类
@Override
protected ContainerManagerImpl
    createContainerManager(DeletionService delSrvc) {
  return new ContainerManagerImpl(context, exec, delSrvc, nodeStatusUpdater,
    metrics, dirsHandler) {
    @Override
    public void
        setBlockNewContainerRequests(boolean blockNewContainerRequests) {
      // do nothing
    }

    @Override
    protected UserGroupInformation getRemoteUgi() throws YarnException {
      ApplicationId appId = ApplicationId.newInstance(0, 0);
      ApplicationAttemptId appAttemptId =
          ApplicationAttemptId.newInstance(appId, 1);
      UserGroupInformation ugi =
          UserGroupInformation.createRemoteUser(appAttemptId.toString(), false);
      ugi.addTokenIdentifier(new NMTokenIdentifier(appAttemptId, context
        .getNodeId(), user, context.getNMTokenSecretManager().getCurrentKey()
        .getKeyId()));
      return ugi;
    }
  };
}