[ https://issues.apache.org/jira/browse/MESOS-3062?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14635680#comment-14635680 ]
Adam B commented on MESOS-3062: ------------------------------- I agree with using the "framework principal", but for the operator endpoints, it should be authorized against the authenticated http user, not just the "master". > Add authorization for dynamic reservation > ----------------------------------------- > > Key: MESOS-3062 > URL: https://issues.apache.org/jira/browse/MESOS-3062 > Project: Mesos > Issue Type: Task > Components: master > Reporter: Michael Park > Assignee: Michael Park > > Dynamic reservations should be authorized with the {{principal}} of the > reserving entity (framework or master). The idea is to introduce {{Reserve}} > and {{Unreserve}} into the ACL. > {code} > message Reserve { > // Subjects. > required Entity principals = 1; > // Objects. MVP: Only possible values = ANY, NONE > required Entity resources = 1; > } > message Unreserve { > // Subjects. > required Entity principals = 1; > // Objects. > required Entity reserver_principals = 2; > } > {code} > When a framework/operator reserves resources, "reserve" ACLs are checked to > see if the framework ({{FrameworkInfo.principal}}) or the operator > ({{Credential.user}}) is authorized to reserve the specified resources. If > not authorized, the reserve operation is rejected. > When a framework/operator unreserves resources, "unreserve" ACLs are checked > to see if the framework ({{FrameworkInfo.principal}}) or the operator > ({{Credential.user}}) is authorized to unreserve the resources reserved by a > framework or operator ({{Resource.ReservationInfo.principal}}). If not > authorized, the unreserve operation is rejected. -- This message was sent by Atlassian JIRA (v6.3.4#6332)