Security Updates: More Seamless Access Controls with Apache Spark and Apache Ranger

SECURITY UPDATES:
More Seamless Access Controls with
Apache Spark and Apache Ranger
Dongjoon Hyun @ Hortonworks Spark Team
Jason Dere @ Hortonworks Hive Team
June 2017

SECURITY UPDATES:
Dongjoon Hyun

3 © Hortonworks Inc. 2011 – 2017. All Rights Reserved
Agenda
Security Issues
Goals
Components
How it works
Demo

Background – Security
 One of fundamental features for enterprise adoption
– Multi-tenancy: Billing team / Data science team / Marketing teams
 Row and column-level access control for SQL users
– Row filtering
– Column masking
 Must enforce shared policies to various SQL engines simultaneously
– E.g. Apache Spark 2.1/1.6 and Apache Hive 2.1

Issue 1
 Spark reads all or nothing
 Directory/file-based permissions are insufficient for fine-grained
access control
Apache Spark is a general data processing engine
scala> val textFile = sc.textFile(“/apps/hive/warehouse/…")
textFile: org.apache.spark.rdd.RDD[String] = …

Issue 2
 Permission 777 on warehouse?
Security starts from storage
Bad
Good

Issue 3
 New policies for SparkSQL?
 Rewrite Spark apps?
– Special data source tables
 Duplicated data maintained manually
– Filtered rows
– Removed or masked columns
Overhead during starting and maintaining security policies

Agenda
Security Issues
Goals
Components
How it works
Demo

Goal 1: Spark SQL Apps
Support row/column-level security with the batch apps
from pyspark.sql import SparkSession
spark = SparkSession
.builder
.enableHiveSupport()
.getOrCreate()
spark.sql("SELECT * FROM db_common.t_customer").show()
db_common
t_customer
…

Goal 2: Spark shells (1/2)
Support row/column-level security in all shells
spark-shell
pyspark

Goal 2: Spark shells (2/2)
Support row/column-level security in all shells
sparkR
spark-sql

Goal 3: Spark Thrift Server
Support row/column-level security with Spark Thrift Server
Login as `billing`
Login as `datascience`

SECURITY UPDATES:
Jason Dere @ Hortonworks Hive Team

Agenda
Security Issues
Goals
Components
How it works
Demo

What are required?
 Apache Ranger
 Apache Hive with LLAP
 Spark-LLAP (Apache License)
– A library and patches to integrate above tech with SparkSQL

Apache Ranger
Provide a standard authorization method across many Hadoop components
https://hortonworks.com/apache/ranger/#section_2

Ranger Policies – Column Access

Ranger Policies – Column Masking

Ranger Policies – Row Filtering

YARN Cluster
HiveServer2
Client App
Hive Query
Coordinator
SQL Query:
select name from users
1
Apache Hive with LLAP
5
3 4
1.Client sends query to HiveServer2.
2.Query plan generation by HiveServer2.
3.Query plan sent to query coordinator
4.Query plan sent to LLAP daemons for
execution.
5.Results consolidated and sent to client
Plan Generation
TableScan: users
Projection: name
2
LLAP
LLAP
LLAP Daemons

Hive Security with Ranger
 Seamless integration with Ranger user-level access policies
– Column/row based security policies are applied automatically
– Hive query plans rewritten to apply masking/filtering functions on top of
the base table data.

YARN Cluster
HiveServer2
Client App
Hive Query
Coordinator
SQL Query:
1
HiveServer2 + LLAP
5
3 4
execution.
Plan Generation
TableScan: users
Projection: name
2
LLAP
LLAP
LLAP Daemons

YARN Cluster
HiveServer2
Client App
Hive Query
Coordinator
Plan Generation
TableScan: users
Filter: state = ‘CA’
Projection: mask(name)
SQL Query:
Ranger security policies applied. Plan
modified based on dynamic security policies.
execution. Filtering/masking performed.
1
HiveServer2 + LLAP + Ranger
Ranger
Dynamic Policies
5 2
3 4
LLAP
LLAP
LLAP Daemons

External LLAP Client
 LLAP Daemon
– Persistent daemons combining query execution and in-memory caching
– External applications also able to use LLAP to retrieve data
• Provide a secure relational datanode view of the data

LLAP
LLAP
LLAP Daemons
YARN Cluster
HiveServer2
Hive Query
Coordinator
Plan Generation
TableScan: users
Projection: name
1.Client requests data locations known as
“splits” from HiveServer2.
3.Splits returned to client which include signed
query plan.
4.LLAP splits used by client to securely submit
query plan to LLAP. Data returned to client.
1
External LLAP Client
3 2
4
Client App
LLAP
InputFormat
SQL Query:

YARN Cluster
HiveServer2
Client App
Hive Query
Coordinator
Plan Generation
TableScan: users
Projection: mask(name)
1.Client requests data locations known as
“splits” from HiveServer2.
Ranger security policies applied. Plan
modified based on dynamic security policies.
3.Splits returned to client which include signed
query plan.
4.LLAP splits used by client to securely submit
query plan to LLAP. Filtering/masking
performed. Data returned to client.
1
External LLAP Client + Ranger
Ranger
Dynamic Policies
3 2
LLAP
InputFormat
SQL Query:
LLAP
LLAP
LLAP Daemons
4

Agenda
Security Issues
Goals
Components
How it works
Demo

Spark-LLAP
 Spark connector library + patches on top of Spark
 Table data read securely through LLAP
 Leverages standard Ranger policies to control per-user
access/masking/filtering of data

Spark-LLAP: Credentials
 HDFS Delegation Token
– HDFSCredentialProvider gets it from namenode
 Hive Metastore Delegation Token
– HiveCredentialProvider gets it from Hive Metastore
 HiveServer2 Delegation Token
– HiveServer2CredentialProvider gets it from HiveServer2
Get and renew delegation tokens
Spark-LLAP
Existing

Spark-LLAP: LlapMetastoreCatalog
LlapMetastoreCatalog: Replaces MetastoreRelation with LlapRelation
SELECT gender, count(*)
FROM db_common.t_customer
WHERE name LIKE '%Obama’
GROUP BY gender
LlapRelation
SubqueryAlias
Analyzed Logical Plan
Filter: name like %Obama
Aggregate: gender
UnresolvedRelation
Parsed Logical Plan
Aggregate: gender

Spark-LLAP: LlapMetastoreCatalog
LlapMetastoreCatalog: Replaces MetastoreRelation with LlapRelation
Without Spark-LLAP
With Spark-LLAP

YARN Cluster
HiveServer2
LlapRelation
Hive Query
Coordinator
Plan Generation
TableScan: users
Projection mask(name)
1
Spark-LLAP: LlapRelation
Ranger
Dynamic Policies
3 2
LLAP
InputFormat
SQL Query:
LLAP
LLAP
LLAP Daemons
4
Uses LLAP external client API to read table data

Spark-LLAP: LlapRelation
LlapRelation supports predicate pushdown and column pruning
LlapRelation
SubqueryAlias
Analyzed Logical Plan
Aggregate: gender
LlapRelation
Filter: EndsWith(name,Obama)
Optimized Logical Plan
Project: gender
Aggregate: gender
Scan LlapRelation
PushedFilter: StringEndsWith(…)
ReadSchema: gender
Filter: EndsWith(name, Obama)
Physical Plan
Project: gender
HashAggregate: gender
…

Using Spark-LLAP
 spark-submit
--package spark-llap.jar
--conf spark.sql.hive.llap=true
--conf spark.yarn.security.credentials.hiveserver2.enabled=true
--master yarn
--deploy-mode cluster
sql.py
Launch Spark jobs `--package` option is supported, too
Easy to turn on/off
Only used for YARN cluster mode

Agenda
Security Issues
Goals
Components
How it works
Demo

Spark-LLAP for Spark 1.6 (TP)
• Use Ranger for SELECT statement
• Use LlapContext
HDP 2.5.X
Milestone
Spark-LLAP for Spark 2.1.0 (TP)
• Use Ranger for more statements (in STS)
• No need to rewrite codes
• Support all languages and shells
HDP 2.6.0 HDP 2.6.1
Spark-LLAP for Spark 2.1.1 (TP)
• Support YARN cluster mode
• Support Hive complex types
Spark-LLAP for Spark 2.2.0
• Available soon in GitHub
HDP X.X.X

Resources
 GitHub
– https://github.com/hortonworks-spark/spark-llap
 Maven
– http://repo.hortonworks.com/content/groups/public/com/hortonworks/spark/spark-
llap_2.11/
 Youtube Demo
– https://www.youtube.com/watch?v=_-oYpQGWm5k (HDP 2.6.1)
 Hortonworks Blog
– https://hortonworks.com/blog/row-column-level-control-apache-spark/
 Hortonworks Community Connection Article
– https://community.hortonworks.com/articles/101181/rowcolumn-level-security-in-sql-for-
apache-spark-2.html
 Support Matrix
– https://github.com/hortonworks-spark/spark-llap/wiki/7.-Support-Matrix

Summary
 Support row/column-level security with
– Spark apps with YARN client/cluster mode
– Spark shells
– Spark Thrift Server
 You can use the existing Spark 2.X SQL apps and scripts
 Easy to turn on/off with only configurations
 Ranger enforces Hive/Spark simultaneously and consistently
Spark-LLAP with HDP 2.6.1 is TP

Acknowledgement
 Apache Hive / Apache Spark / Apache Ranger Community
 Bikas Saha, Mingjie Tang, Saisai Shao, Siddharth Seth, Sergey
Shelukhin, Thejas Nair, Zhan Zhang, and many others

Thank you

Security Updates: More Seamless Access Controls with Apache Spark and Apache Ranger

More Related Content

What's hot (20)

Similar to Security Updates: More Seamless Access Controls with Apache Spark and Apache Ranger (20)

More from DataWorks Summit (20)

Recently uploaded (20)

Security Updates: More Seamless Access Controls with Apache Spark and Apache Ranger