|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | +package org.apache.spark.deploy.rest.kubernetes.v2 |
| 18 | + |
| 19 | +import java.io.File |
| 20 | + |
| 21 | +import com.google.common.base.Charsets |
| 22 | +import com.google.common.io.Files |
| 23 | + |
| 24 | +import org.apache.spark.{SecurityManager => SparkSecurityManager, SparkConf, SparkException, SSLOptions} |
| 25 | +import org.apache.spark.deploy.kubernetes.config._ |
| 26 | +import org.apache.spark.deploy.rest.kubernetes.v1.PemsToKeyStoreConverter |
| 27 | +import org.apache.spark.internal.Logging |
| 28 | + |
| 29 | +private[spark] trait ResourceStagingServerSslOptionsProvider { |
| 30 | + def getSslOptions: SSLOptions |
| 31 | +} |
| 32 | + |
| 33 | +private[spark] class ResourceStagingServerSslOptionsProviderImpl(sparkConf: SparkConf) |
| 34 | + extends ResourceStagingServerSslOptionsProvider with Logging { |
| 35 | + def getSslOptions: SSLOptions = { |
| 36 | + val baseSslOptions = new SparkSecurityManager(sparkConf) |
| 37 | + .getSSLOptions("kubernetes.resourceStagingServer") |
| 38 | + val maybeKeyPem = sparkConf.get(RESOURCE_STAGING_SERVER_KEY_PEM) |
| 39 | + val maybeCertPem = sparkConf.get(RESOURCE_STAGING_SERVER_CERT_PEM) |
| 40 | + val maybeKeyStorePasswordFile = sparkConf.get(RESOURCE_STAGING_SERVER_KEYSTORE_PASSWORD_FILE) |
| 41 | + val maybeKeyPasswordFile = sparkConf.get(RESOURCE_STAGING_SERVER_KEYSTORE_KEY_PASSWORD_FILE) |
| 42 | + |
| 43 | + logSslConfigurations( |
| 44 | + baseSslOptions, maybeKeyPem, maybeCertPem, maybeKeyStorePasswordFile, maybeKeyPasswordFile) |
| 45 | + |
| 46 | + requireNandDefined(baseSslOptions.keyStore, maybeKeyPem, |
| 47 | + "Shouldn't provide both key PEM and keyStore files for TLS.") |
| 48 | + requireNandDefined(baseSslOptions.keyStore, maybeCertPem, |
| 49 | + "Shouldn't provide both certificate PEM and keyStore files for TLS.") |
| 50 | + requireNandDefined(baseSslOptions.keyStorePassword, maybeKeyStorePasswordFile, |
| 51 | + "Shouldn't provide both the keyStore password value and the keyStore password file.") |
| 52 | + requireNandDefined(baseSslOptions.keyPassword, maybeKeyPasswordFile, |
| 53 | + "Shouldn't provide both the keyStore key password value and the keyStore key password file.") |
| 54 | + requireBothOrNeitherDefined( |
| 55 | + maybeKeyPem, |
| 56 | + maybeCertPem, |
| 57 | + "When providing a certificate PEM file, the key PEM file must also be provided.", |
| 58 | + "When providing a key PEM file, the certificate PEM file must also be provided.") |
| 59 | + |
| 60 | + val resolvedKeyStorePassword = baseSslOptions.keyStorePassword |
| 61 | + .orElse(maybeKeyStorePasswordFile.map { keyStorePasswordFile => |
| 62 | + safeFileToString(keyStorePasswordFile, "KeyStore password file") |
| 63 | + }) |
| 64 | + val resolvedKeyStoreKeyPassword = baseSslOptions.keyPassword |
| 65 | + .orElse(maybeKeyPasswordFile.map { keyPasswordFile => |
| 66 | + safeFileToString(keyPasswordFile, "KeyStore key password file") |
| 67 | + }) |
| 68 | + val resolvedKeyStore = baseSslOptions.keyStore |
| 69 | + .orElse(maybeKeyPem.map { keyPem => |
| 70 | + val keyPemFile = new File(keyPem) |
| 71 | + val certPemFile = new File(maybeCertPem.get) |
| 72 | + PemsToKeyStoreConverter.convertPemsToTempKeyStoreFile( |
| 73 | + keyPemFile, |
| 74 | + certPemFile, |
| 75 | + "key", |
| 76 | + resolvedKeyStorePassword, |
| 77 | + resolvedKeyStoreKeyPassword, |
| 78 | + baseSslOptions.keyStoreType) |
| 79 | + }) |
| 80 | + baseSslOptions.copy( |
| 81 | + keyStore = resolvedKeyStore, |
| 82 | + keyStorePassword = resolvedKeyStorePassword, |
| 83 | + keyPassword = resolvedKeyStoreKeyPassword) |
| 84 | + } |
| 85 | + |
| 86 | + private def logSslConfigurations( |
| 87 | + baseSslOptions: SSLOptions, |
| 88 | + maybeKeyPem: Option[String], |
| 89 | + maybeCertPem: Option[String], |
| 90 | + maybeKeyStorePasswordFile: Option[String], |
| 91 | + maybeKeyPasswordFile: Option[String]) = { |
| 92 | + logDebug("The following SSL configurations were provided for the resource staging server:") |
| 93 | + logDebug(s"KeyStore File: ${baseSslOptions.keyStore.map(_.getAbsolutePath).getOrElse("N/A")}") |
| 94 | + logDebug("KeyStore Password: " + |
| 95 | + baseSslOptions.keyStorePassword.map(_ => "<present_but_redacted>").getOrElse("N/A")) |
| 96 | + logDebug(s"KeyStore Password File: ${maybeKeyStorePasswordFile.getOrElse("N/A")}") |
| 97 | + logDebug("Key Password: " + |
| 98 | + baseSslOptions.keyPassword.map(_ => "<present_but_redacted>").getOrElse("N/A")) |
| 99 | + logDebug(s"Key Password File: ${maybeKeyPasswordFile.getOrElse("N/A")}") |
| 100 | + logDebug(s"KeyStore Type: ${baseSslOptions.keyStoreType.getOrElse("N/A")}") |
| 101 | + logDebug(s"Key PEM: ${maybeKeyPem.getOrElse("N/A")}") |
| 102 | + logDebug(s"Certificate PEM: ${maybeCertPem.getOrElse("N/A")}") |
| 103 | + } |
| 104 | + |
| 105 | + private def requireBothOrNeitherDefined( |
| 106 | + opt1: Option[_], |
| 107 | + opt2: Option[_], |
| 108 | + errMessageWhenFirstIsMissing: String, |
| 109 | + errMessageWhenSecondIsMissing: String): Unit = { |
| 110 | + requireSecondIfFirstIsDefined(opt1, opt2, errMessageWhenSecondIsMissing) |
| 111 | + requireSecondIfFirstIsDefined(opt2, opt1, errMessageWhenFirstIsMissing) |
| 112 | + } |
| 113 | + |
| 114 | + private def requireSecondIfFirstIsDefined( |
| 115 | + opt1: Option[_], opt2: Option[_], errMessageWhenSecondIsMissing: String): Unit = { |
| 116 | + opt1.foreach { _ => |
| 117 | + require(opt2.isDefined, errMessageWhenSecondIsMissing) |
| 118 | + } |
| 119 | + } |
| 120 | + |
| 121 | + private def requireNandDefined(opt1: Option[_], opt2: Option[_], errMessage: String): Unit = { |
| 122 | + opt1.foreach { _ => require(opt2.isEmpty, errMessage) } |
| 123 | + } |
| 124 | + |
| 125 | + private def safeFileToString(filePath: String, fileType: String): String = { |
| 126 | + val file = new File(filePath) |
| 127 | + if (!file.isFile) { |
| 128 | + throw new SparkException(s"$fileType provided at ${file.getAbsolutePath} does not exist or" |
| 129 | + + s" is not a file.") |
| 130 | + } |
| 131 | + Files.toString(file, Charsets.UTF_8) |
| 132 | + } |
| 133 | +} |
0 commit comments