Pārlūkot izejas kodu

[jb] Verify certificate in secure when talking to RM over rest https (ssl)

Suhas Satish 11 gadi atpakaļ
vecāks
revīzija
c2d0d19

+ 7 - 3
desktop/conf.dist/hue.ini

@@ -616,14 +616,18 @@
       ## proxy_api_url=http://localhost:8088
 
       # URL of the HistoryServer API
-      # history_server_api_url=http://localhost:19888
+      ## history_server_api_url=http://localhost:19888
+
+      # In secure mode (HTTPS), if SSL certificates from Resource Manager's
+      # Rest Server have to be verified against certificate authority
+      ## ssl_cert_ca_verify=False
 
     # HA support by specifying multiple clusters
     # e.g.
 
     # [[[ha]]]
       # Resource Manager logical name (required for HA)
-      # logical_name=my-rm-name
+      ## logical_name=my-rm-name
 
   # Configuration for MapReduce (MR1)
   # ------------------------------------------------------------------------
@@ -653,7 +657,7 @@
 
     # [[[ha]]]
       # Enter the logical name of the JobTrackers
-      # logical_name=my-jt-name
+      ## logical_name=my-jt-name
 
 
 ###########################################################################

+ 6 - 2
desktop/conf/pseudo-distributed.ini.tmpl

@@ -623,7 +623,11 @@
       ## proxy_api_url=http://localhost:8088
 
       # URL of the HistoryServer API
-      # history_server_api_url=http://localhost:19888
+      ## history_server_api_url=http://localhost:19888
+
+      # In secure mode (HTTPS), if SSL certificates from Resource Manager's
+      # Rest Server have to be verified against certificate authority
+      ## ssl_cert_ca_verify=False
 
     # HA support by specifying multiple clusters
     # e.g.
@@ -660,7 +664,7 @@
 
     # [[[ha]]]
       # Enter the logical name of the JobTrackers
-      # logical_name=my-jt-name
+      ## logical_name=my-jt-name
 
 
 ###########################################################################

+ 4 - 0
desktop/core/src/desktop/lib/rest/http_client.py

@@ -107,6 +107,10 @@ class HttpClient(object):
   def logger(self):
     return self._logger
 
+  def set_verify(self, verify=True):
+    self._session.verify = verify
+    return self
+      
   def _get_headers(self, headers):
     if headers:
       self._session.headers.update(headers)

+ 4 - 0
desktop/libs/hadoop/src/hadoop/conf.py

@@ -141,6 +141,10 @@ YARN_CLUSTERS = UnspecifiedConfigSection(
       HISTORY_SERVER_API_URL=Config("history_server_api_url",
                   default='http://localhost:19888',
                   help="URL of the HistoryServer API"),
+      SSL_CERT_CA_VERIFY=Config("ssl_cert_ca_verify",
+                  help="In secure mode (HTTPS), if SSL certificates from Resource Manager Rest Server have to be verified against certificate authority",
+                  default=False,
+                  type=coerce_bool)
     )
   )
 )

+ 5 - 2
desktop/libs/hadoop/src/hadoop/yarn/resource_manager_api.py

@@ -48,21 +48,24 @@ def get_resource_manager():
         yarn_cluster = cluster.get_cluster_conf_for_job_submission()
         if yarn_cluster is None:
           raise PopupException(_('No Resource Manager are available.'))
-        _api_cache = ResourceManagerApi(yarn_cluster.RESOURCE_MANAGER_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get())
+        _api_cache = ResourceManagerApi(yarn_cluster.RESOURCE_MANAGER_API_URL.get(), yarn_cluster.SECURITY_ENABLED.get(), yarn_cluster.SSL_CERT_CA_VERIFY.get())
     finally:
       _api_cache_lock.release()
   return _api_cache
 
 
 class ResourceManagerApi(object):
-  def __init__(self, oozie_url, security_enabled=False):
+  def __init__(self, oozie_url, security_enabled=False, ssl_cert_ca_verify=False):
     self._url = posixpath.join(oozie_url, 'ws', _API_VERSION)
     self._client = HttpClient(self._url, logger=LOG)
     self._root = Resource(self._client)
     self._security_enabled = security_enabled
+    self._ssl_cert_ca_verify = ssl_cert_ca_verify
 
     if self._security_enabled:
       self._client.set_kerberos_auth()
+      if ssl_cert_ca_verify:
+        self._client.set_verify(True)
 
   def __str__(self):
     return "ResourceManagerApi at %s" % (self._url,)