瀏覽代碼

HUE-2367 [yarn] Ensure checking of SSL certificates is on or off

Romain Rigaux 10 年之前
父節點
當前提交
ac5d732

+ 4 - 4
desktop/conf.dist/hue.ini

@@ -335,8 +335,8 @@
         ## Use search bind authentication.
         ## search_bind_authentication=true
 
-	# Whether or not to follow referrals
-	## follow_referrals=false
+        # Whether or not to follow referrals
+        ## follow_referrals=false
 
         ## [[[[[users]]]]]
 
@@ -689,8 +689,8 @@
       # URL of the HistoryServer API
       ## history_server_api_url=http://localhost:19888
 
-      # In secure mode (HTTPS), if SSL certificates from Resource Manager's
-      # Rest Server have to be verified against certificate authority
+      # In secure mode (HTTPS), if SSL certificates from from YARN Rest APIs
+      # have to be verified against certificate authority
       ## ssl_cert_ca_verify=False
 
     # HA support by specifying multiple clusters

+ 2 - 2
desktop/conf/pseudo-distributed.ini.tmpl

@@ -695,8 +695,8 @@
       # URL of the HistoryServer API
       ## history_server_api_url=http://localhost:19888
 
-      # In secure mode (HTTPS), if SSL certificates from Resource Manager's
-      # Rest Server have to be verified against certificate authority
+      # In secure mode (HTTPS), if SSL certificates from YARN Rest APIs
+      # have to be verified against certificate authority
       ## ssl_cert_ca_verify=False
 
     # HA support by specifying multiple clusters

+ 1 - 1
desktop/libs/hadoop/src/hadoop/conf.py

@@ -148,7 +148,7 @@ YARN_CLUSTERS = UnspecifiedConfigSection(
                   default='http://localhost:19888',
                   help="URL of the HistoryServer API"),
       SSL_CERT_CA_VERIFY=Config("ssl_cert_ca_verify",
-                  help="In secure mode (HTTPS), if SSL certificates from Resource Manager Rest Server have to be verified against certificate authority",
+                  help="In secure mode (HTTPS), if SSL certificates from YARN Rest APIs have to be verified against certificate authority",
                   default=False,
                   type=coerce_bool)
     )

+ 4 - 2
desktop/libs/hadoop/src/hadoop/yarn/history_server_api.py

@@ -41,7 +41,7 @@ def get_history_server_api():
     try:
       if _api_cache is None:
         yarn_cluster = cluster.get_cluster_conf_for_job_submission()
-        _api_cache = HistoryServerApi(yarn_cluster.HISTORY_SERVER_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get())
+        _api_cache = HistoryServerApi(yarn_cluster.HISTORY_SERVER_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get(), yarn_cluster.SSL_CERT_CA_VERIFY.get())
     finally:
       _api_cache_lock.release()
   return _api_cache
@@ -49,7 +49,7 @@ def get_history_server_api():
 
 class HistoryServerApi(object):
 
-  def __init__(self, oozie_url, security_enabled=False):
+  def __init__(self, oozie_url, security_enabled=False, ssl_cert_ca_verify=False):
     self._url = posixpath.join(oozie_url, 'ws/%s/history' % _API_VERSION)
     self._client = HttpClient(self._url, logger=LOG)
     self._root = Resource(self._client)
@@ -58,6 +58,8 @@ class HistoryServerApi(object):
     if self._security_enabled:
       self._client.set_kerberos_auth()
 
+    self._client.set_verify(ssl_cert_ca_verify)
+
   def __str__(self):
     return "HistoryServerApi at %s" % (self._url,)
 

+ 4 - 2
desktop/libs/hadoop/src/hadoop/yarn/mapreduce_api.py

@@ -42,7 +42,7 @@ def get_mapreduce_api():
     try:
       if _api_cache is None:
         yarn_cluster = cluster.get_cluster_conf_for_job_submission()
-        _api_cache = MapreduceApi(yarn_cluster.PROXY_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get())
+        _api_cache = MapreduceApi(yarn_cluster.PROXY_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get(), yarn_cluster.SSL_CERT_CA_VERIFY.get())
     finally:
       _api_cache_lock.release()
   return _api_cache
@@ -50,7 +50,7 @@ def get_mapreduce_api():
 
 class MapreduceApi(object):
 
-  def __init__(self, oozie_url, security_enabled=False):
+  def __init__(self, oozie_url, security_enabled=False, ssl_cert_ca_verify=False):
     self._url = posixpath.join(oozie_url, 'proxy')
     self._client = HttpClient(self._url, logger=LOG)
     self._root = Resource(self._client)
@@ -59,6 +59,8 @@ class MapreduceApi(object):
     if self._security_enabled:
       self._client.set_kerberos_auth()
 
+    self._client.set_verify(ssl_cert_ca_verify)
+
   def __str__(self):
     return "MapreduceApi at %s" % (self._url,)
 

+ 5 - 2
desktop/libs/hadoop/src/hadoop/yarn/node_manager_api.py

@@ -33,11 +33,12 @@ _JSON_CONTENT_TYPE = 'application/json'
 
 
 def get_resource_manager_api(api_url):
-  return ResourceManagerApi(api_url, cluster.get_cluster_conf_for_job_submission().SECURITY_ENABLED.get())
+  yarn_cluster = cluster.get_cluster_conf_for_job_submission()
+  return ResourceManagerApi(api_url, yarn_cluster.SECURITY_ENABLED.get(), yarn_cluster.SSL_CERT_CA_VERIFY.get())
 
 
 class ResourceManagerApi(object):
-  def __init__(self, oozie_url, security_enabled=False):
+  def __init__(self, oozie_url, security_enabled=False, ssl_cert_ca_verify=False):
     self._url = posixpath.join(oozie_url, 'ws', _API_VERSION)
     self._client = HttpClient(self._url, logger=LOG)
     self._root = Resource(self._client)
@@ -46,6 +47,8 @@ class ResourceManagerApi(object):
     if self._security_enabled:
       self._client.set_kerberos_auth()
 
+    self._client.set_verify(ssl_cert_ca_verify)
+
   def __str__(self):
     return "NodeManagerApi at %s" % (self._url,)
 

+ 2 - 3
desktop/libs/hadoop/src/hadoop/yarn/resource_manager_api.py

@@ -60,12 +60,11 @@ class ResourceManagerApi(object):
     self._client = HttpClient(self._url, logger=LOG)
     self._root = Resource(self._client)
     self._security_enabled = security_enabled
-    self._ssl_cert_ca_verify = ssl_cert_ca_verify
 
     if self._security_enabled:
       self._client.set_kerberos_auth()
-      if ssl_cert_ca_verify:
-        self._client.set_verify(True)
+
+    self._client.set_verify(ssl_cert_ca_verify)
 
   def __str__(self):
     return "ResourceManagerApi at %s" % (self._url,)