ApacheDolphinScheduler 整合大数据生态安全门 Apache Knox，统一对外服务

海豚调度 2022-08-16

2088

点亮 ⭐️ Star · 照亮开源之路

GitHub:https://github.com/apache/dolphinscheduler

作者简介

张柏强，ApacheDolphinscheduler Contributor，大数据开发工程师，主要研究方向为实时计算、元数据治理、大数据基础组件。

概述

Apache DolphinScheduler是Apache顶级项目之一，定位是大数据生态中主打性能，易用，稳定，云原生的调度系统，其通过拖拉拽的方式快速编排DAG作业，同时支持资源管理、数据源管理、插件化开发、多环境执行、多机器执行，是目前最火的调度系统之一。

Apache Knox是Apache 的顶级项目之一，定位是大数据生态中的一道安全门，用于统一代理大数据生态中的所有端口，类Nginx，目前国内文档较少。

为什么要用Knox而不用Nginx

基于内部需求，需要为使用者统一提供大数据生态组件UI入口，同时将所有的组件进行加密，统一ldap登录，相比较于Nginx来说Knox完美提供了这一点，刚开始是通过跟梓豪大佬沟通，推荐我使用Apache Knox。总之是一把辛酸泪，Knox文档极其少，本地开发环境不好搭建，英文文档看的我一知半解，机翻更难懂，所以便写了一份记录，供遇到该需求的小伙伴参考。

定义规则

首先说一下我们为什么要用到Knox。在大数据生态中，各种组件五花八门，所以导致了需要开放的端口和IP是非常多的，而作为组件提供方，为了使使用者有更好的体验，以及增加Hadoop生态的安全性，所以我们便需要用到ApacheKnox，来进行一个统一的对外访问，Knox支持了API，UI，Jdbc，MetastoreServer统一代理，目前在Knox中，提供了开箱即用的规则包括Hadoop，Hive，Hbase，Spark，Flink，Druid，Presto...等大数据生态常用组件，但是其不支持Apache DolphinScheduler，我们便进行一个自定义扩展，使我们能够统一账号，统一提供对外访问的端口，屏蔽掉Apache DolphinScheduler的12345(default) port，增加Apache DolphinScheduler的安全性.Knox的规则通过service.xml和rewrite.xml来进行规则定义，在这里我提供一个代理Apache DolphinScheduler的UI和API的规则，其他的定义可以参考knox官网。

3.1

UI 规则

service.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at


       http://www.apache.org/licenses/LICENSE-2.0


   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-->
<service role="DOLPHINSCHEDULERUI" name="dolphinscheduler" version="3.0.0">
    <metadata>
        <type>UI</type>
        <context>/dolphinscheduler/</context>
        <shortDesc>Dolphinscheduler ui</shortDesc>
        <description>YARN Resource Manager Web interface (v1)</description>
    </metadata>
    <routes>
        <route path="/dolphinscheduler/">
            <rewrite apply="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/root" to="request.body"/>
        </route>


        <route path="/dolphinscheduler/ui/*/*/*">
            <rewrite apply="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/style" to="request.body"/>
        </route>


        <route path="/dolphinscheduler/ui/*/*">
            <rewrite apply="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/statis" to="request.body"/>
        </route>


    </routes>
    <dispatch classname="org.apache.knox.gateway.dispatch.DefaultDispatch" ha-classname="org.apache.knox.gateway.rm.dispatch.RMUIHaDispatch"/>


</service>

rewrite.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at


       http://www.apache.org/licenses/LICENSE-2.0


   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-->
<rules>


    <rule dir="IN" name="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/root" pattern="*://*:*/**/dolphinscheduler/">
        <rewrite template="{$serviceUrl[DOLPHINSCHEDULERUI]}/view/login/index.html"/>
    </rule>


    <rule dir="IN" name="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/style" pattern="*://*:*/**/dolphinscheduler/ui/{**}/{**}/{**}">
        <rewrite template="{$serviceUrl[DOLPHINSCHEDULERUI]}/{**}"/>
    </rule>


    <rule dir="OUT" name="DOLPHINSCHEDULERUI/dolphinscheduler/outbound/style" pattern="/dolphinscheduler/ui/{**}/{**}/{**}">
        <rewrite template="dolphinscheduler/ui/{**}"/>
    </rule>




    <rule dir="IN" name="DOLPHINSCHEDULERUI/dolphinscheduler/inbound/statis" pattern="*://*:*/**/dolphinscheduler/ui/{**}/{**}">
        <rewrite template="{$serviceUrl[DOLPHINSCHEDULERUI]}/{**}"/>
    </rule>


    <rule dir="OUT" name="DOLPHINSCHEDULERUI/dolphinscheduler/outbound/statis" pattern="/dolphinscheduler/ui/{**}/{**}">
        <rewrite template="dolphinscheduler/ui/{**}"/>
    </rule>


</rules>

3.2

API 规则

rewrite.xml
<rules>
    <!-- KNOX-1918 prevent global HDFS rules from triggering -->
    <rule dir="OUT" name="DOLPHINSCHEDULER-API/dolphinscheduler/outbound" pattern="hdfs://{host}/{path=**}?{**}">
        <rewrite template="hdfs://{host}/{path=**}?{**}"/>
    </rule>
    <rule dir="IN" name="DOLPHINSCHEDULER-API/dolphinscheduler/inbound" pattern="*://*:*/**/dolphinscheduler/api/{path=**}?{**}">
        <rewrite template="{$serviceUrl[DOLPHINSCHEDULER-API]}/api/{path=**}?{**}"/>
    </rule>
</rules>

service.xml
<service role="DOLPHINSCHEDULER-API" name="dolphinscheduler-api" version="3.0.0">
    <metadata>
        <type>API</type>
        <context>/dolphinscheduler/api</context>
        <shortDesc>dolphinscheduler API</shortDesc>
        <description>Dolphinscheduler the provided scheduling system UI supports fast scheduling of DAG by dragging and dragging</description>
        <samples>
            <sample>
                <description>Retrieve data for the specified attribute search query</description>
                <method>POST</method>
                <path>dolphinscheduler/login</path>
            </sample>
            <sample>
                <description>If you want to learn more api for dolphinscheduler, please refer here</description>
                <value>https://dolphinscheduler.apache.org/en-us/docs/latest/user_doc/guide/open-api.html</value>
            </sample>
        </samples>
    </metadata>
    <routes>
        <route path="/dolphinscheduler/api/**"/>
    </routes>


    <dispatch classname="org.apache.knox.gateway.dispatch.DefaultDispatch"/>
</service>

代理测试

sandbox.xml
<?xml version="1.0" encoding="utf-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at


      http://www.apache.org/licenses/LICENSE-2.0


  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<topology>


    <gateway>


        <provider>
            <role>authentication</role>
            <name>ShiroProvider</name>
            <enabled>true</enabled>
            <param>
                <!-- 
                session timeout in minutes,  this is really idle timeout,
                defaults to 30mins, if the property value is not defined,, 
                current client authentication would expire if client idles contiuosly for more than this value
                -->
                <name>sessionTimeout</name>
                <value>30</value>
            </param>
            <param>
                <name>main.ldapRealm</name>
                <value>org.apache.knox.gateway.shirorealm.KnoxLdapRealm</value>
            </param>
            <param>
                <name>main.ldapContextFactory</name>
                <value>org.apache.knox.gateway.shirorealm.KnoxLdapContextFactory</value>
            </param>
            <param>
                <name>main.ldapRealm.contextFactory</name>
                <value>$ldapContextFactory</value>
            </param>
            <param>
                <name>main.ldapRealm.userDnTemplate</name>
                <value>uid={0},ou=people,dc=hadoop,dc=apache,dc=org</value>
            </param>
            <param>
                <name>main.ldapRealm.contextFactory.url</name>
                <value>ldap://localhost:33389</value>
            </param>
            <param>
                <name>main.ldapRealm.contextFactory.authenticationMechanism</name>
                <value>simple</value>
            </param>
            <param>
                <name>urls./**</name>
                <value>authcBasic</value>
            </param>
        </provider>


        <provider>
            <role>identity-assertion</role>
            <name>Default</name>
            <enabled>true</enabled>
        </provider>


        <provider>
            <role>hostmap</role>
            <name>static</name>
            <enabled>true</enabled>
            <param>
                <name>localhost</name>
                <value>sandbox,sandbox.hortonworks.com</value>
            </param>
        </provider>


    </gateway>


    <service>
        <role>DOLPHINSCHEDULER</role>
        <url>http://127.0.0.1:12345</url>
        <version>3.0.0</version>
    </service>
  
    <service>
        <role>DOLPHINSCHEDULER-API</role>
        <url>http://127.0.0.1:12345</url>
        <version>3.0.0</version>
    </service>


    ........


</topology>

浏览器请求https://localhost:8443/gateway/sandbox/dolphinScheduler即可。

LDAP 整合

5.1 配置Apache DolphinScheduler以ldap账户登录

application.yaml
security:
  authentication:
    # Authentication types (supported types: PASSWORD,LDAP)
    type: LDAP
    # IF you set type `LDAP`, below config will be effective
    ldap:
      # ldap server config
      urls: ldap://localhost:33389/
      base-dn: dc=hadoop,dc=apache,dc=org
      username: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
      password: admin-password
      user:
        # admin userId when you use LDAP login
        admin: admin
        identity-attribute: uid
        email-attribute: mail
        # action when ldap user is not exist (supported types: CREATE,DENY)
        not-exist-action: DENY