Project: mesos
Issue MESOS-3065: Add framework authorization for persistent volume
This is the third in a series of tickets that adds authorization support to persistent volumes. When a framework creates a persistent volume, "create" ACLs are checked to see if the framework (FrameworkInfo.principal) or the operator (Credential.user) is authorized to create persistent volumes. If not authorized, the create operation is rejected. When a framework destroys a persistent volume, "destroy" ACLs are checked to see if the framework (FrameworkInfo.principal) or the operator (Credential.user) is authorized to destroy the persistent volume created by a framework or operator (Resource.DiskInfo.principal). If not authorized, the destroy operation is rejected. A separate ticket will use the structures created here to enable authorization of the "/create" and "/destroy" HTTP endpoints: https://issues.apache.org/jira/browse/MESOS-3903
Story points: 5