Package org.apache.hadoop.ozone.om

Interface OMMultiTenantManager

All Known Implementing Classes:
OMMultiTenantManagerImpl
@Private @Unstable public interface OMMultiTenantManager
OM MultiTenant manager interface.

  • Field Details

  • Method Details

    • start

      void start() throws IOException
      Start background thread(s) in the multi-tenant manager.
      Throws:
      IOException

    • stop

      void stop() throws IOException
      Stop background thread(s) in the multi-tenant manager.
      Throws:
      IOException

    • getOMRangerBGSyncService

      OMRangerBGSyncService getOMRangerBGSyncService()
      Returns the instance of OMRangerBGSyncService.

    • getOmMetadataManager

      org.apache.hadoop.ozone.om.OMMetadataManager getOmMetadataManager()
      Returns the corresponding OzoneManager instance.
      Returns:
      OMMetadataManager

    • getAuthorizerOp

      TenantOp getAuthorizerOp()

    • getCacheOp

      TenantOp getCacheOp()

    • getUserNameGivenAccessId

      String getUserNameGivenAccessId(String accessId)
      Given an accessId, return kerberos user name for the tenant user.

    • getDefaultAccessId

      static String getDefaultAccessId(String tenantId, String userPrincipal)
      Get the default Access ID string given tenant name and user name.
      Parameters:
      tenantId - tenant name
      userPrincipal - user name
      Returns:
      access ID in the form of tenantName$username

    • isTenantAdmin

      boolean isTenantAdmin(org.apache.hadoop.security.UserGroupInformation callerUgi, String tenantId, boolean delegated)
      Returns true if user is the tenant's admin or Ozone admin, false otherwise.
      Parameters:
      callerUgi - caller's UserGroupInformation
      tenantId - tenant name
      delegated - if set to true, checks if the user is a delegated tenant admin; if set to false, checks if the user is a tenant admin, delegated or not

    • listUsersInTenant

      org.apache.hadoop.ozone.om.helpers.TenantUserList listUsersInTenant(String tenantID, String prefix) throws IOException
      List all the user and accessIDs of all users that belong to this Tenant. Note this read is unprotected. See OzoneManager#listUserInTenant
      Parameters:
      tenantID -
      Returns:
      List of users
      Throws:
      IOException

    • getTenantForAccessID

      Optional<String> getTenantForAccessID(String accessID) throws IOException
      Given an access ID return its corresponding tenant.
      Parameters:
      accessID -
      Returns:
      String tenant name
      Throws:
      IOException

    • getDefaultUserRoleName

      static String getDefaultUserRoleName(String tenantId)
      Get default user role name given tenant name.
      Parameters:
      tenantId - tenant name
      Returns:
      user role name. e.g. tenant1-UserRole

    • getDefaultAdminRoleName

      static String getDefaultAdminRoleName(String tenantId)
      Get default admin role name given tenant name.
      Parameters:
      tenantId - tenant name
      Returns:
      admin role name. e.g. tenant1-AdminRole

    • getDefaultBucketNamespacePolicyName

      static String getDefaultBucketNamespacePolicyName(String tenantId)
      Get default bucket namespace (volume) policy name given tenant name.
      Parameters:
      tenantId - tenant name
      Returns:
      bucket namespace (volume) policy name. e.g. tenant1-VolumeAccess

    • getDefaultBucketPolicyName

      static String getDefaultBucketPolicyName(String tenantId)
      Get default bucket policy name given tenant name.
      Parameters:
      tenantId - tenant name
      Returns:
      bucket policy name. e.g. tenant1-BucketAccess

    • checkAdmin

      void checkAdmin() throws org.apache.hadoop.ozone.om.exceptions.OMException
      Passes check only when caller is an Ozone (cluster) admin, throws OMException otherwise.
      Throws:
      org.apache.hadoop.ozone.om.exceptions.OMException - PERMISSION_DENIED

    • checkTenantAdmin

      void checkTenantAdmin(String tenantId, boolean delegated) throws org.apache.hadoop.ozone.om.exceptions.OMException
      Check if caller is a tenant admin of the specified tenant. Ozone admins will always pass this check. Throws PERMISSION_DENIED if the check failed.
      Parameters:
      tenantId - tenant name
      delegated - if set to true, only delegated tenant admins can pass this check; if false, both delegated and non-delegated tenant admins will pass this check.
      Throws:
      org.apache.hadoop.ozone.om.exceptions.OMException - PERMISSION_DENIED

    • checkTenantExistence

      void checkTenantExistence(String tenantId) throws org.apache.hadoop.ozone.om.exceptions.OMException
      Check if the tenantId exists in the table, throws TENANT_NOT_FOUND if not.
      Throws:
      org.apache.hadoop.ozone.om.exceptions.OMException

    • getTenantVolumeName

      String getTenantVolumeName(String tenantId) throws IOException
      Retrieve volume name of the tenant. Throws OMException TENANT_NOT_FOUND if tenantId doesn't exist.
      Throws:
      IOException

    • getTenantUserRoleName

      String getTenantUserRoleName(String tenantId) throws IOException
      Retrieve user role name of the given tenant.
      Parameters:
      tenantId - tenant name
      Returns:
      tenant user role name
      Throws:
      IOException

    • getTenantAdminRoleName

      String getTenantAdminRoleName(String tenantId) throws IOException
      Retrieve admin role name of the given tenant.
      Parameters:
      tenantId - tenant name
      Returns:
      tenant user role name
      Throws:
      IOException

    • getTenantFromDBById

      org.apache.hadoop.ozone.om.multitenant.Tenant getTenantFromDBById(String tenantId) throws IOException
      Get Tenant object of given tenant name from OM DB.
      Parameters:
      tenantId - tenant name
      Returns:
      Tenant
      Throws:
      IOException

    • isUserAccessIdPrincipalOrTenantAdmin

      boolean isUserAccessIdPrincipalOrTenantAdmin(String accessId, org.apache.hadoop.security.UserGroupInformation ugi) throws IOException
      Throws:
      IOException

    • isTenantEmpty

      boolean isTenantEmpty(String tenantId) throws IOException
      Returns true if the tenant doesn't have any accessIds assigned to it Returns false otherwise.
      Parameters:
      tenantId -
      Throws:
      IOException

    • checkAndEnableMultiTenancy

      static boolean checkAndEnableMultiTenancy(OzoneManager ozoneManager, org.apache.hadoop.hdds.conf.OzoneConfiguration conf)
      Returns true if Multi-Tenancy can be successfully enabled given the OM instance and conf; returns false if ozone.om.multitenancy.enabled = false Config validation will be performed on conf if the intent to enable Multi-Tenancy is specified (i.e. ozone.om.multitenancy.enabled = true), if the validation failed, an exception will be thrown to prevent OM from starting up.

    • getDefaultVolumeAccessPolicy

      static MultiTenantAccessController.Policy getDefaultVolumeAccessPolicy(String tenantId, String volumeName, String userRoleName, String adminRoleName) throws IOException
      Returns default VolumeAccess policy given tenant and role names.
      Throws:
      IOException

    • getDefaultBucketAccessPolicy

      static MultiTenantAccessController.Policy getDefaultBucketAccessPolicy(String tenantId, String volumeName, String userRoleName) throws IOException
      Returns default BucketAccess policy given tenant and user role name.
      Throws:
      IOException

    • getAuthorizerLock

      AuthorizerLock getAuthorizerLock()