Function TEST_P

src/tests/master_authorization_tests.cpp:2677–2994

This test verifies that allowing or denying an action will only result in a success or failure on specific operations but not other operations in an accept call. This is a regression test for MESOS-9474 and MESOS-9480.

// success or failure on specific operations but not other operations in an
// accept call. This is a regression test for MESOS-9474 and MESOS-9480.
TEST_P(MasterOperationAuthorizationTest, Accept)
{
  Clock::pause();

  const auto controllableApprover =
    std::make_shared<ControllableObjectApprover>(true);

  MockAuthorizer authorizer;

  const authorization::Action allowedAction = GetParam();
  EXPECT_CALL(authorizer, getApprover(_, _))
    .WillRepeatedly(Invoke([controllableApprover, allowedAction](
                               const Option<authorization::Subject>&,
                               const authorization::Action& action) {
      return action == allowedAction ? getAcceptingObjectApprover()
                                     : controllableApprover;
    }));

  Try<Owned<cluster::Master>> master = StartMaster(&authorizer);
  ASSERT_SOME(master);

  // First, we create a list of operations to exercise all authorization
  // actions, and compute the total resources needed by these operations and set
  // up their expected terminal states.
  //
  // NOTE: We create some `RUN_TASK` operations in the beginning and some in the
  // end for two reasons: 1. These operations doesn't have operation IDs so
  // needs to be handled differently. 2. By adding some operations for the
  // `RUN_TASK` action in the end, we can verify that their results are not
  // affected by preceding authorizations.
  vector<v1::Offer::Operation> operations;
  v1::Resources totalResources;
  hashmap<v1::TaskID, v1::TaskState> expectedTaskStates;
  hashmap<v1::OperationID, v1::OperationState> expectedOperationStates;

  // NOTE: Because we create operations before getting an offer, we synthesize
  // the framework ID and agent ID here and check them later.
  v1::FrameworkID frameworkId;
  frameworkId.set_value(master.get()->getMasterInfo().id() + "-0000");
  v1::AgentID agentId;
  agentId.set_value(master.get()->getMasterInfo().id() + "-S0");

  auto addRunTaskOperations = [&] {
    foreach (
        v1::Offer::Operation& operation,
        createOperations(frameworkId, agentId, authorization::RUN_TASK)) {
      if (operation.type() == v1::Offer::Operation::LAUNCH) {
        foreach (const v1::TaskInfo& task, operation.launch().task_infos()) {
          totalResources += task.resources();
          totalResources += task.executor().resources();

          expectedTaskStates.put(
              task.task_id(),
              authorization::RUN_TASK == GetParam()
                ? v1::TASK_FINISHED : v1::TASK_ERROR);
        }
      } else if (operation.type() == v1::Offer::Operation::LAUNCH_GROUP) {
        totalResources += operation.launch_group().executor().resources();