Skip to content

Commit f17aed0

Browse files
agilelab-tmnd1991tmnd1991
authored andcommitted
1 parent 4f0f5a5 commit f17aed0

File tree

5 files changed

+198
-2
lines changed

5 files changed

+198
-2
lines changed

hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/Constants.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1607,4 +1607,21 @@ private Constants() {
16071607
*/
16081608
public static final boolean CHECKSUM_VALIDATION_DEFAULT = false;
16091609

1610+
/**
1611+
* Are extensions classes, such as {@code fs.s3a.aws.credentials.provider},
1612+
* going to be loaded from the same classloader that loaded
1613+
* the {@link S3AFileSystem}?
1614+
* It is useful to turn classloader isolation off for Apache Spark applications
1615+
* that might load {@link S3AFileSystem} from the Spark distribution (Launcher classloader)
1616+
* while users might want to provide custom extensions (loaded by Spark MutableClassloader).
1617+
* Value: {@value}.
1618+
*/
1619+
public static final String AWS_S3_CLASSLOADER_ISOLATION =
1620+
"fs.s3a.classloader.isolation";
1621+
1622+
/**
1623+
* Default value for {@link #AWS_S3_CLASSLOADER_ISOLATION}.
1624+
* Value: {@value}.
1625+
*/
1626+
public static final boolean DEFAULT_AWS_S3_CLASSLOADER_ISOLATION = true;
16101627
}

hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AFileSystem.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -559,8 +559,8 @@ public void initialize(URI name, Configuration originalConf)
559559

560560
// fix up the classloader of the configuration to be whatever
561561
// classloader loaded this filesystem.
562-
// See: HADOOP-17372
563-
conf.setClassLoader(this.getClass().getClassLoader());
562+
// See: HADOOP-17372 and follow-up on HADOOP-18993
563+
S3AUtils.maybeIsolateClassloader(conf, this.getClass().getClassLoader());
564564

565565
// patch the Hadoop security providers
566566
patchSecurityCredentialProviders(conf);

hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1693,4 +1693,25 @@ public static Map<String, String> getTrimmedStringCollectionSplitByEquals(
16931693
.getTrimmedStringCollectionSplitByEquals(valueString);
16941694
}
16951695

1696+
1697+
/**
1698+
* If classloader isolation is {@code true}
1699+
* (through {@link Constants#AWS_S3_CLASSLOADER_ISOLATION}) or not
1700+
* explicitly set, then the classLoader of the input configuration object
1701+
* will be set to the input classloader, otherwise nothing will happen.
1702+
* @param conf configuration object.
1703+
* @param classLoader isolated classLoader.
1704+
*/
1705+
static void maybeIsolateClassloader(Configuration conf, ClassLoader classLoader) {
1706+
if (conf.getBoolean(Constants.AWS_S3_CLASSLOADER_ISOLATION,
1707+
Constants.DEFAULT_AWS_S3_CLASSLOADER_ISOLATION)) {
1708+
LOG.debug("Configuration classloader set to S3AFileSystem classloader: {}", classLoader);
1709+
conf.setClassLoader(classLoader);
1710+
} else {
1711+
LOG.debug("Configuration classloader not changed, support classes needed will be loaded " +
1712+
"from the classloader that instantiated the Configuration object: {}",
1713+
conf.getClassLoader());
1714+
}
1715+
}
1716+
16961717
}

hadoop-tools/hadoop-aws/src/site/markdown/tools/hadoop-aws/index.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,6 +590,30 @@ obtain the credentials needed to access AWS services in the role the EC2 VM
590590
was deployed as.
591591
This AWS credential provider is enabled in S3A by default.
592592

593+
## Custom AWS Credential Providers and Apache Spark
594+
595+
Apache Spark employs two class loaders, one that loads "distribution" (Spark + Hadoop) classes and one that
596+
loads custom user classes. If the user wants to load custom implementations of AWS credential providers,
597+
custom signers, delegation token providers or any other dynamically loaded extension class
598+
through user provided jars she will need to set the following configuration:
599+
600+
```xml
601+
<property>
602+
<name>fs.s3a.classloader.isolation</name>
603+
<value>false</value>
604+
</property>
605+
<property>
606+
<name>fs.s3a.aws.credentials.provider</name>
607+
<value>CustomCredentialsProvider</value>
608+
</property>
609+
```
610+
611+
If the following property is not set or set to `true`, the following exception will be thrown:
612+
613+
```
614+
java.io.IOException: From option fs.s3a.aws.credentials.provider java.lang.ClassNotFoundException: Class CustomCredentialsProvider not found
615+
```
616+
593617

594618
## <a name="hadoop_credential_providers"></a>Storing secrets with Hadoop Credential Providers
595619

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
package org.apache.hadoop.fs.s3a;
20+
21+
import java.io.IOException;
22+
import java.util.HashMap;
23+
import java.util.Map;
24+
import java.util.function.Consumer;
25+
26+
import org.assertj.core.api.Assertions;
27+
import org.junit.Test;
28+
29+
import org.apache.hadoop.conf.Configuration;
30+
import org.apache.hadoop.fs.FileSystem;
31+
32+
/**
33+
* Checks that classloader isolation for loading extension classes is applied
34+
* correctly. Both default, true and false tests performed.
35+
* See {@link Constants#AWS_S3_CLASSLOADER_ISOLATION} property and
36+
* HADOOP-17372 and follow-up on HADOOP-18993 for more info.
37+
*/
38+
public class ITestS3AFileSystemIsolatedClassloader extends AbstractS3ATestBase {
39+
40+
private static class CustomClassLoader extends ClassLoader {
41+
}
42+
43+
private final ClassLoader customClassLoader = new CustomClassLoader();
44+
45+
private S3AFileSystem createNewTestFs(Configuration conf) throws IOException {
46+
S3AFileSystem fs = new S3AFileSystem();
47+
fs.initialize(getFileSystem().getUri(), conf);
48+
return fs;
49+
}
50+
51+
/**
52+
* Asserts that the given assertions are valid in a new filesystem context.
53+
* The filesystem is created after setting the context classloader to
54+
* {@link ITestS3AFileSystemIsolatedClassloader#customClassLoader} in this way we are
55+
* able to check if the classloader is reset during the initialization or not.
56+
*
57+
* @param confToSet The configuration settings to be applied to the new filesystem.
58+
* @param asserts The assertions to be performed on the new filesystem.
59+
* @throws IOException If an I/O error occurs.
60+
*/
61+
private void assertInNewFilesystem(Map<String, String> confToSet, Consumer<FileSystem> asserts)
62+
throws IOException {
63+
ClassLoader previousClassloader = Thread.currentThread().getContextClassLoader();
64+
try {
65+
Thread.currentThread().setContextClassLoader(customClassLoader);
66+
Configuration conf = new Configuration();
67+
Assertions.assertThat(conf.getClassLoader()).isEqualTo(customClassLoader);
68+
S3ATestUtils.prepareTestConfiguration(conf);
69+
for (Map.Entry<String, String> e : confToSet.entrySet()) {
70+
conf.set(e.getKey(), e.getValue());
71+
}
72+
try (S3AFileSystem fs = createNewTestFs(conf)) {
73+
asserts.accept(fs);
74+
}
75+
} finally {
76+
Thread.currentThread().setContextClassLoader(previousClassloader);
77+
}
78+
}
79+
80+
private Map<String, String> mapOf() {
81+
return new HashMap<>();
82+
}
83+
84+
private Map<String, String> mapOf(String key, String value) {
85+
HashMap<String, String> m = new HashMap<>();
86+
m.put(key, value);
87+
return m;
88+
}
89+
90+
@Test
91+
public void defaultIsolatedClassloader() throws IOException {
92+
assertInNewFilesystem(mapOf(), (fs) -> {
93+
Assertions.assertThat(fs.getConf().getClassLoader())
94+
.describedAs("The classloader used to load s3a fs extensions")
95+
.isNotEqualTo(Thread.currentThread().getContextClassLoader())
96+
.describedAs("the current classloader");
97+
98+
Assertions.assertThat(fs.getConf().getClassLoader())
99+
.describedAs("The classloader used to load s3a fs extensions")
100+
.isEqualTo(fs.getClass().getClassLoader())
101+
.describedAs("the classloader that loaded the fs");
102+
});
103+
}
104+
105+
@Test
106+
public void isolatedClassloader() throws IOException {
107+
assertInNewFilesystem(mapOf(Constants.AWS_S3_CLASSLOADER_ISOLATION, "true"), (fs) -> {
108+
Assertions.assertThat(fs.getConf().getClassLoader())
109+
.describedAs("The classloader used to load s3a fs extensions")
110+
.isNotEqualTo(Thread.currentThread().getContextClassLoader())
111+
.describedAs("the current context classloader");
112+
113+
Assertions.assertThat(fs.getConf().getClassLoader())
114+
.describedAs("The classloader used to load s3a fs extensions")
115+
.isEqualTo(fs.getClass().getClassLoader())
116+
.describedAs("the classloader that loaded the fs");
117+
});
118+
}
119+
120+
@Test
121+
public void notIsolatedClassloader() throws IOException {
122+
assertInNewFilesystem(mapOf(Constants.AWS_S3_CLASSLOADER_ISOLATION, "false"), (fs) -> {
123+
Assertions.assertThat(fs.getConf().getClassLoader())
124+
.describedAs("The classloader used to load s3a fs extensions")
125+
.isEqualTo(Thread.currentThread().getContextClassLoader())
126+
.describedAs("the current context classloader");
127+
128+
Assertions.assertThat(fs.getConf().getClassLoader())
129+
.describedAs("The classloader used to load s3a fs extensions")
130+
.isNotEqualTo(fs.getClass().getClassLoader())
131+
.describedAs("the classloader that loaded the fs");
132+
});
133+
}
134+
}

0 commit comments

Comments
 (0)