jerryshao commented on code in PR #13724: URL: https://github.com/apache/gravitino/pull/13724#discussion_r4247299534
########## plugins/k8s-job-executor/src/main/java/org/apache/gravitino/job/k8s/K8sClientUtils.java: ########## @@ -0,0 +1,273 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.gravitino.job.k8s; + +import com.google.common.base.Preconditions; +import io.fabric8.kubernetes.api.model.NamedContext; +import io.fabric8.kubernetes.client.Config; +import io.fabric8.kubernetes.client.ConfigBuilder; +import io.fabric8.kubernetes.client.KubernetesClient; +import io.fabric8.kubernetes.client.KubernetesClientBuilder; +import io.fabric8.kubernetes.client.OAuthTokenProvider; +import java.io.File; +import java.io.IOException; +import java.io.UncheckedIOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.attribute.FileTime; +import java.util.concurrent.TimeUnit; +import java.util.regex.Pattern; +import javax.annotation.Nullable; +import org.apache.commons.lang3.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** Creates the Kubernetes client of the job cluster from the job executor configurations. */ +public final class K8sClientUtils { + + /** + * An {@link OAuthTokenProvider} that reads the token from a file, and reads it again whenever the + * file changes, so that a rotated token is picked up without restarting the server. + */ + static final class FileTokenProvider implements OAuthTokenProvider { Review Comment: Gravitino does not refresh the token, it only reads the file again when the file changes. Whoever provides the file refreshes it, and yes, in the usual setups the kubelet is the one that updates the file inside the pod: - `tokenFile` is meant for a job cluster other than the one Gravitino runs in (`masterUrl` mode). The token of that cluster is typically put into a Secret and mounted into the Gravitino pod. Something has to update the Secret when the token is rotated, for example an admin, External Secrets, or a job that requests a new token from the job cluster. The kubelet then updates the mounted file, usually within a minute or so. One caveat: a Secret mounted with `subPath` is not updated by the kubelet. - If the file is a projected service account token volume, the kubelet rotates the token itself before it expires. That token is for the cluster the pod runs in, so it fits when a custom audience or path is wanted there. - When Gravitino runs in the job cluster and neither `masterUrl` nor `kubeconfig` is set, `tokenFile` is not needed: the client uses the pod's service account token through its own in-cluster lookup. I added this to the Javadoc of `FileTokenProvider` and of the `tokenFile` configuration in 240529815, and it will go into the deployment guide (#13618). _🤖 Addressed by [Claude Code](https://claude.com/claude-code)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
