Skip to content

Commit 2a77456

Browse files
1 parent 8444f69 commit 2a77456

File tree

4 files changed

+186
-2
lines changed

4 files changed

+186
-2
lines changed

hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/Constants.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1583,4 +1583,21 @@ private Constants() {
15831583
*/
15841584
public static final boolean CHECKSUM_VALIDATION_DEFAULT = false;
15851585

1586+
/**
1587+
* Are extensions classes, such as {@code fs.s3a.aws.credentials.provider},
1588+
* going to be loaded from the same classloader that loaded
1589+
* the {@link S3AFileSystem}?
1590+
* It is useful to turn classloader isolation off for Apache Spark applications
1591+
* that might load {@link S3AFileSystem} from the Spark distribution (Launcher classloader)
1592+
* while users might want to provide custom extensions (loaded by Spark MutableClassloader).
1593+
* Value: {@value}.
1594+
*/
1595+
public static final String AWS_S3_CLASSLOADER_ISOLATION =
1596+
"fs.s3a.classloader.isolation";
1597+
1598+
/**
1599+
* Default value for {@link #AWS_S3_CLASSLOADER_ISOLATION}.
1600+
* Value: {@value}.
1601+
*/
1602+
public static final boolean DEFAULT_AWS_S3_CLASSLOADER_ISOLATION = true;
15861603
}

hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AFileSystem.java

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -563,8 +563,8 @@ public void initialize(URI name, Configuration originalConf)
563563

564564
// fix up the classloader of the configuration to be whatever
565565
// classloader loaded this filesystem.
566-
// See: HADOOP-17372
567-
conf.setClassLoader(this.getClass().getClassLoader());
566+
// See: HADOOP-17372 and follow-up on HADOOP-18993
567+
isolateClassloader(conf, this.getClass().getClassLoader());
568568

569569
// patch the Hadoop security providers
570570
patchSecurityCredentialProviders(conf);
@@ -764,6 +764,26 @@ public void initialize(URI name, Configuration originalConf)
764764
}
765765
}
766766

767+
/**
768+
* If classloader isolation is {@code true}
769+
* (through {@link Constants#AWS_S3_CLASSLOADER_ISOLATION}) or not
770+
* explicitly set, then the classLoader of the input configuration object
771+
* will be set to the input classloader, otherwise nothing will happen.
772+
* @param conf configuration object.
773+
* @param classLoader isolated classLoader.
774+
*/
775+
private void isolateClassloader(Configuration conf, ClassLoader classLoader) {
776+
if (conf.getBoolean(Constants.AWS_S3_CLASSLOADER_ISOLATION,
777+
Constants.DEFAULT_AWS_S3_CLASSLOADER_ISOLATION)) {
778+
LOG.debug("Configuration classloader set to S3AFileSystem classloader: {}", classLoader);
779+
conf.setClassLoader(classLoader);
780+
} else {
781+
LOG.debug("Configuration classloader not changed, support classes needed will be loaded " +
782+
"from the classloader that instantiated the Configuration object: {}",
783+
conf.getClassLoader());
784+
}
785+
}
786+
767787
/**
768788
* Populates the configurations related to vectored IO operation
769789
* in the context which has to passed down to input streams.

hadoop-tools/hadoop-aws/src/site/markdown/tools/hadoop-aws/index.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -566,6 +566,30 @@ obtain the credentials needed to access AWS services in the role the EC2 VM
566566
was deployed as.
567567
This AWS credential provider is enabled in S3A by default.
568568

569+
## Custom AWS Credential Providers and Apache Spark
570+
571+
Apache Spark employs two class loaders, one that loads "distribution" (Spark + Hadoop) classes and one that
572+
loads custom user classes. If the user wants to load custom implementations of AWS credential providers,
573+
custom signers, delegation token providers or any other dynamically loaded extension class
574+
through user provided jars she will need to set the following configuration:
575+
576+
```xml
577+
<property>
578+
<name>fs.s3a.classloader.isolation</name>
579+
<value>false</value>
580+
</property>
581+
<property>
582+
<name>fs.s3a.aws.credentials.provider</name>
583+
<value>CustomCredentialsProvider</value>
584+
</property>
585+
```
586+
587+
If the following property is not set or set to `true`, the following exception will be thrown:
588+
589+
```
590+
java.io.IOException: From option fs.s3a.aws.credentials.provider java.lang.ClassNotFoundException: Class CustomCredentialsProvider not found
591+
```
592+
569593

570594
## <a name="hadoop_credential_providers"></a>Storing secrets with Hadoop Credential Providers
571595

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
package org.apache.hadoop.fs.s3a;
20+
21+
import java.io.IOException;
22+
import java.util.HashMap;
23+
import java.util.Map;
24+
import java.util.function.Consumer;
25+
26+
import org.assertj.core.api.Assertions;
27+
import org.junit.Test;
28+
29+
import org.apache.hadoop.conf.Configuration;
30+
import org.apache.hadoop.fs.FileSystem;
31+
32+
public class ITestS3AFileSystemIsolatedClassloader extends AbstractS3ATestBase {
33+
34+
public static class CustomClassLoader extends ClassLoader {
35+
}
36+
37+
private final ClassLoader customClassLoader = new CustomClassLoader();
38+
39+
private S3AFileSystem createNewTestFs(Configuration conf) {
40+
try {
41+
S3AFileSystem fs = new S3AFileSystem();
42+
fs.initialize(getFileSystem().getUri(), conf);
43+
return fs;
44+
} catch (IOException e) {
45+
throw new RuntimeException(e);
46+
}
47+
}
48+
49+
private void test(Map<String, String> confToSet, Consumer<FileSystem> asserts)
50+
throws IOException {
51+
ClassLoader previousClassloader = Thread.currentThread().getContextClassLoader();
52+
try {
53+
Thread.currentThread().setContextClassLoader(customClassLoader);
54+
Configuration conf = new Configuration();
55+
Assertions.assertThat(conf.getClassLoader()).isEqualTo(customClassLoader);
56+
S3ATestUtils.prepareTestConfiguration(conf);
57+
for (Map.Entry<String, String> e : confToSet.entrySet()) {
58+
conf.set(e.getKey(), e.getValue());
59+
}
60+
try (S3AFileSystem fs = createNewTestFs(conf)) {
61+
asserts.accept(fs);
62+
}
63+
} finally {
64+
Thread.currentThread().setContextClassLoader(previousClassloader);
65+
}
66+
}
67+
68+
private Map<String, String> mapOf() {
69+
return new HashMap<>();
70+
}
71+
72+
private Map<String, String> mapOf(String key, String value) {
73+
HashMap<String, String> m = new HashMap<>();
74+
m.put(key, value);
75+
return m;
76+
}
77+
78+
@Test
79+
public void defaultIsolatedClassloader() throws IOException {
80+
test(mapOf(), (fs) -> {
81+
Assertions.assertThat(fs.getConf().getClassLoader())
82+
.describedAs("The classloader used to load s3a fs extensions")
83+
.isNotEqualTo(Thread.currentThread().getContextClassLoader())
84+
.describedAs("the current classloader");
85+
86+
Assertions.assertThat(fs.getConf().getClassLoader())
87+
.describedAs("The classloader used to load s3a fs extensions")
88+
.isEqualTo(fs.getClass().getClassLoader())
89+
.describedAs("the classloader that loaded the fs");
90+
;
91+
});
92+
}
93+
94+
@Test
95+
public void isolatedClassloader() throws IOException {
96+
test(mapOf(Constants.AWS_S3_CLASSLOADER_ISOLATION, "true"), (fs) -> {
97+
Assertions.assertThat(fs.getConf().getClassLoader())
98+
.describedAs("The classloader used to load s3a fs extensions")
99+
.isNotEqualTo(Thread.currentThread().getContextClassLoader())
100+
.describedAs("the current context classloader");
101+
102+
Assertions.assertThat(fs.getConf().getClassLoader())
103+
.describedAs("The classloader used to load s3a fs extensions")
104+
.isEqualTo(fs.getClass().getClassLoader())
105+
.describedAs("the classloader that loaded the fs");
106+
});
107+
}
108+
109+
@Test
110+
public void notIsolatedClassloader() throws IOException {
111+
test(mapOf(Constants.AWS_S3_CLASSLOADER_ISOLATION, "false"), (fs) -> {
112+
Assertions.assertThat(fs.getConf().getClassLoader())
113+
.describedAs("The classloader used to load s3a fs extensions")
114+
.isEqualTo(Thread.currentThread().getContextClassLoader())
115+
.describedAs("the current context classloader");
116+
117+
Assertions.assertThat(fs.getConf().getClassLoader())
118+
.describedAs("The classloader used to load s3a fs extensions")
119+
.isNotEqualTo(fs.getClass().getClassLoader())
120+
.describedAs("the classloader that loaded the fs");
121+
});
122+
}
123+
}

0 commit comments

Comments
 (0)