This is an automated email from the ASF dual-hosted git repository.
sarutak pushed a commit to branch branch-4.x
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/branch-4.x by this push:
new 1a771a467d65 [SPARK-58722][CORE] Bump OIDC credential propagation
version annotations from `4.3.0` to `4.4.0`
1a771a467d65 is described below
commit 1a771a467d654b363cb70d8543f6a3e0c483777a
Author: Kousuke Saruta <[email protected]>
AuthorDate: Thu Aug 13 14:09:04 2026 +0900
[SPARK-58722][CORE] Bump OIDC credential propagation version annotations
from `4.3.0` to `4.4.0`
### What changes were proposed in this pull request?
This PR updates `since` and `.version()` annotations for all OIDC
credential propagation APIs and configuration keys from `4.3.0` to `4.4.0` to
reflect the actual release version.
The OIDC credential propagation feature was originally developed targeting
`4.3.0` but will ship in `4.4.0`. This PR corrects the version annotations
accordingly.
**Affected files:**
- `TokenIngestor.java`
- `CredentialProvider.java`
- `FileTokenIngestor.java`
- `CredentialProviderLoader.java`
- `CredentialResolutionException.java`
- `UserCredentials.java`
- `ServiceCredential.java`
- `UserContext.java`
- `config/package.scala` (`spark.security.oidc.*` keys)
**Note:** `AwsStsCredentialProvider.java` (`connector/credential-aws`) also
contains `since 4.3.0` but is excluded from this PR because it will be
corrected to `4.4.0` as part of #57655
### Why are the changes needed?
Version annotations should reflect the actual release in which APIs and
configurations become available, not the originally planned version during
development.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
GA.
### Was this patch authored or co-authored using generative AI tooling?
Kiro CLI / Claude
Closes #57947 from sarutak/oidc-propagation/version-bump-4.4.0.
Authored-by: Kousuke Saruta <[email protected]>
Signed-off-by: Kousuke Saruta <[email protected]>
(cherry picked from commit 0b5896ba1e8e24d7709a1eab0724180dbedc29b0)
Signed-off-by: Kousuke Saruta <[email protected]>
---
.../java/org/apache/spark/security/CredentialProvider.java | 12 ++++++------
.../org/apache/spark/security/CredentialProviderLoader.java | 2 +-
.../apache/spark/security/CredentialResolutionException.java | 2 +-
.../java/org/apache/spark/security/FileTokenIngestor.java | 2 +-
.../java/org/apache/spark/security/ServiceCredential.java | 2 +-
.../main/java/org/apache/spark/security/TokenIngestor.java | 2 +-
.../src/main/java/org/apache/spark/security/UserContext.java | 2 +-
.../main/java/org/apache/spark/security/UserCredentials.java | 2 +-
.../scala/org/apache/spark/internal/config/package.scala | 8 ++++----
9 files changed, 17 insertions(+), 17 deletions(-)
diff --git
a/core/src/main/java/org/apache/spark/security/CredentialProvider.java
b/core/src/main/java/org/apache/spark/security/CredentialProvider.java
index aae7f0f430a9..a306b427535b 100644
--- a/core/src/main/java/org/apache/spark/security/CredentialProvider.java
+++ b/core/src/main/java/org/apache/spark/security/CredentialProvider.java
@@ -36,7 +36,7 @@ import org.apache.spark.annotation.DeveloperApi;
* Implementations must be thread-safe: {@code resolve()} may be called
concurrently from
* multiple threads after {@code init()} completes.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public interface CredentialProvider extends AutoCloseable {
@@ -58,7 +58,7 @@ public interface CredentialProvider extends AutoCloseable {
*
* @param conf Spark configuration properties scoped to {@code
spark.security.oidc.*}
* keys (must not be null)
- * @since 4.3.0
+ * @since 4.4.0
*/
void init(Map<String, String> conf);
@@ -69,7 +69,7 @@ public interface CredentialProvider extends AutoCloseable {
* set must be non-empty and stable across calls.
*
* @return a non-empty set of supported scheme names
- * @since 4.3.0
+ * @since 4.4.0
*/
Set<String> supportedSchemes();
@@ -85,7 +85,7 @@ public interface CredentialProvider extends AutoCloseable {
* @param target the target URI for which credentials are requested (must
not be null)
* @return a short-lived service credential for the target
* @throws CredentialResolutionException if the credential exchange fails
- * @since 4.3.0
+ * @since 4.4.0
*/
ServiceCredential resolve(UserContext user, URI target) throws
CredentialResolutionException;
@@ -96,7 +96,7 @@ public interface CredentialProvider extends AutoCloseable {
* The default is 15 minutes.
*
* @return the suggested credential TTL (never null)
- * @since 4.3.0
+ * @since 4.4.0
*/
default Duration suggestedTtl() {
return Duration.ofMinutes(15);
@@ -119,7 +119,7 @@ public interface CredentialProvider extends AutoCloseable {
* clause in their override (e.g., declare {@code close()} with no {@code
throws} or
* with a more specific exception type).
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@Override
default void close() throws Exception {}
diff --git
a/core/src/main/java/org/apache/spark/security/CredentialProviderLoader.java
b/core/src/main/java/org/apache/spark/security/CredentialProviderLoader.java
index 84aaaca0a196..50d2a24546e9 100644
--- a/core/src/main/java/org/apache/spark/security/CredentialProviderLoader.java
+++ b/core/src/main/java/org/apache/spark/security/CredentialProviderLoader.java
@@ -59,7 +59,7 @@ import org.apache.spark.annotation.Private;
* {@link CredentialProvider} contract, implementations must be thread-safe,
so a returned
* instance may be used concurrently.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@Private
public final class CredentialProviderLoader {
diff --git
a/core/src/main/java/org/apache/spark/security/CredentialResolutionException.java
b/core/src/main/java/org/apache/spark/security/CredentialResolutionException.java
index eb5aaf237298..86db39835168 100644
---
a/core/src/main/java/org/apache/spark/security/CredentialResolutionException.java
+++
b/core/src/main/java/org/apache/spark/security/CredentialResolutionException.java
@@ -26,7 +26,7 @@ import org.apache.spark.annotation.DeveloperApi;
* This is a checked exception to ensure callers handle credential resolution
failures
* explicitly (e.g., retry, fail the job, or fall back to another mechanism).
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public class CredentialResolutionException extends Exception {
diff --git
a/core/src/main/java/org/apache/spark/security/FileTokenIngestor.java
b/core/src/main/java/org/apache/spark/security/FileTokenIngestor.java
index b51dcc7f0b43..c43fd5dc601c 100644
--- a/core/src/main/java/org/apache/spark/security/FileTokenIngestor.java
+++ b/core/src/main/java/org/apache/spark/security/FileTokenIngestor.java
@@ -50,7 +50,7 @@ import org.apache.spark.internal.SparkLoggerFactory;
* returns empty rather than throwing</li>
* </ul>
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@Private
public class FileTokenIngestor implements TokenIngestor {
diff --git
a/core/src/main/java/org/apache/spark/security/ServiceCredential.java
b/core/src/main/java/org/apache/spark/security/ServiceCredential.java
index b0502cf922a4..4e988821a398 100644
--- a/core/src/main/java/org/apache/spark/security/ServiceCredential.java
+++ b/core/src/main/java/org/apache/spark/security/ServiceCredential.java
@@ -36,7 +36,7 @@ import org.apache.spark.annotation.DeveloperApi;
* <p>
* This class is immutable and {@link Serializable}.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public final class ServiceCredential implements Serializable {
diff --git a/core/src/main/java/org/apache/spark/security/TokenIngestor.java
b/core/src/main/java/org/apache/spark/security/TokenIngestor.java
index 0c25fc59d69e..fd15b5f73438 100644
--- a/core/src/main/java/org/apache/spark/security/TokenIngestor.java
+++ b/core/src/main/java/org/apache/spark/security/TokenIngestor.java
@@ -29,7 +29,7 @@ import org.apache.spark.annotation.DeveloperApi;
* configuration is passed at construction time.
* Implementations must be thread-safe because {@link #load()} may be called
concurrently.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public interface TokenIngestor {
diff --git a/core/src/main/java/org/apache/spark/security/UserContext.java
b/core/src/main/java/org/apache/spark/security/UserContext.java
index 9d9f372dad34..a063c6c2eae1 100644
--- a/core/src/main/java/org/apache/spark/security/UserContext.java
+++ b/core/src/main/java/org/apache/spark/security/UserContext.java
@@ -31,7 +31,7 @@ import org.apache.spark.annotation.DeveloperApi;
* <b>not</b> {@link java.io.Serializable} and must never be transmitted to
executors.
* The {@code rawToken} field is always redacted in {@link #toString()}.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public final class UserContext {
diff --git a/core/src/main/java/org/apache/spark/security/UserCredentials.java
b/core/src/main/java/org/apache/spark/security/UserCredentials.java
index 3f5e1d54b923..3d4427651a0e 100644
--- a/core/src/main/java/org/apache/spark/security/UserCredentials.java
+++ b/core/src/main/java/org/apache/spark/security/UserCredentials.java
@@ -38,7 +38,7 @@ import org.apache.spark.annotation.DeveloperApi;
* This class is transmitted to executors and does <b>not</b> contain any
reference
* to {@link UserContext} or raw identity tokens. It is immutable and {@link
Serializable}.
*
- * @since 4.3.0
+ * @since 4.4.0
*/
@DeveloperApi
public final class UserCredentials implements Serializable {
diff --git a/core/src/main/scala/org/apache/spark/internal/config/package.scala
b/core/src/main/scala/org/apache/spark/internal/config/package.scala
index 53413a1f4bf1..291a17a1a37f 100644
--- a/core/src/main/scala/org/apache/spark/internal/config/package.scala
+++ b/core/src/main/scala/org/apache/spark/internal/config/package.scala
@@ -1710,7 +1710,7 @@ package object config {
.doc("Whether to enable OIDC credential propagation. When enabled, the
driver reads an " +
"identity token from a file, exchanges it for short-lived service
credentials via " +
"CredentialProvider implementations, and propagates those credentials
to executors.")
- .version("4.3.0")
+ .version("4.4.0")
.withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
.booleanConf
.createWithDefault(false)
@@ -1720,7 +1720,7 @@ package object config {
.doc("Path to the OIDC identity token file on the driver. Required when
" +
"spark.security.oidc.enabled is true. The file should contain a JWT
token " +
"(e.g., a Kubernetes projected service account token).")
- .version("4.3.0")
+ .version("4.4.0")
.withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
.stringConf
.createOptional
@@ -1729,7 +1729,7 @@ package object config {
ConfigBuilder("spark.security.oidc.renewal.safetyMargin")
.doc("How long before credential expiry to trigger renewal. Credentials
are refreshed " +
"at min(identity token expiry, service credential expiry) minus this
margin.")
- .version("4.3.0")
+ .version("4.4.0")
.withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
.timeConf(TimeUnit.MILLISECONDS)
.checkValue(_ > 0, "The safety margin must be a positive time value.")
@@ -1739,7 +1739,7 @@ package object config {
ConfigBuilder("spark.security.oidc.renewal.minInterval")
.doc("Minimum interval between credential renewal attempts. This
prevents tight renewal " +
"loops when credentials have very short TTLs or when failures cause
rapid retries.")
- .version("4.3.0")
+ .version("4.4.0")
.withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
.timeConf(TimeUnit.MILLISECONDS)
.checkValue(_ > 0, "The minimum renewal interval must be a positive time
value.")
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
