Policy enforcement for compute nodes

A non-transitory computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

• maintaining, by a policy enforcement system in a first compute node, a plurality of policies and data associating a plurality of user credentials with the plurality of policies;
• intercepting, by the policy enforcement system, a request for data, the request being sent from a compute process to a file system in the first compute node, the request further comprising user credentials, wherein a first task is assigned to the first compute node by a resource manager managing a plurality of tasks comprising the first task and a plurality of compute nodes comprising the first compute node, and wherein the policy enforcement system is logically placed between the compute process and the file system;
• sending the request for data from the policy enforcement system to the file system;
• receiving the data by the policy enforcement system from the file system;
• selecting, by the policy enforcement system from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials;
• filtering, by the policy enforcement system, the data from the file system based on the one or more policies, the filtering causing at least a portion of the data from the file system, when presented, to display as one or more masking characters instead of as originally provided by the file system;
• and
• sending the filtered data by the policy enforcement system to the compute process, the sending allowing a client device to access the filtered data through the compute process.

A system comprising:

• a file system comprising a master node and a plurality of compute nodes;
• and
• a client device configured to submit a request for data from the file system,
• wherein the master node is configured to receive the request from the client device and divide a workload from the request into a plurality of tasks and assign the tasks to the plurality of compute nodes;
• and
• wherein each compute node includes a processor and a computer-readable medium coupled to the processor and having instructions stored thereon, which, when executed by the processor, cause the processor operate a compute process and a policy enforcement system, including causing the processor to perform operations comprising
• receiving at the compute process a first task from the master node;
• maintaining, by the policy enforcement system a plurality of policies and data associating a plurality of user credentials with the plurality of policies;
• intercepting, by the policy enforcement system, a request for data, the request being sent from the compute process to a file system in the compute node, the first task being configured to use the data, the request further comprising user credentials, wherein the policy enforcement system is logically placed between the compute process and the file system;
• sending the request for data from the policy enforcement system to the file system;
• receiving the data from the file system by the policy enforcement system;
• selecting, by the policy enforcement system from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials;
• filtering, by the policy enforcement system, the data from the file system based on the one or more policies, the filtering causing at least a portion of the data from the file system, when presented, to display as one or more masking characters instead of as originally provided by the file system;
• sending the filtered data from the policy enforcement system to the compute process;
• and
• returning a result from the compute process in the compute node to the master node, the returning allowing a client device to access the result.