This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/spark-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new 513ac095 [SPARK-59963] Fix RBAC to allow `Spark` driver to create
`Deployment` and scale executors
513ac095 is described below
commit 513ac095013e35c4f5e78d2e3598230c5a9c7616
Author: Dongjoon Hyun <[email protected]>
AuthorDate: Mon Oct 5 08:14:20 2026 -0700
[SPARK-59963] Fix RBAC to allow `Spark` driver to create `Deployment` and
scale executors
### What changes were proposed in this pull request?
This PR aims to fix the Spark workload `ClusterRole` and `Role`s to allow
the `Spark` driver to create `Deployment`s and to scale executors. The existing
`statefulsets` rule is unchanged.
| Resource in `apps` API group | Before | After |
| --- | --- | --- |
| `deployments` | None | `get`, `create`, `delete` |
| `statefulsets/scale` | None | `get`, `update` |
| `deployments/scale` | None | `get`, `update` |
### Why are the changes needed?
Apache Spark [v4.2.0](https://github.com/apache/spark/releases/tag/v4.2.0)
(2026-07-11) added the `deployment` pods allocator (SPARK-54173), which
`examples/pi-java25-deployment.yaml` uses. Currently, its driver fails to start.
- https://github.com/apache/spark/pull/52867
```
deployments.apps is forbidden: User "system:serviceaccount:default:spark"
cannot create resource "deployments" in API group "apps" in the namespace
"default".
```
In addition, both `statefulset` and `deployment` allocators scale executors
through the `scale` subresource. RBAC does not cover a subresource with a grant
on the resource itself, so the driver also fails to start with dynamic
allocation.
### Does this PR introduce _any_ user-facing change?
Yes. The workload roles grant more permissions than
[1.0.0](https://github.com/apache/spark-kubernetes-operator/releases/tag/1.0.0)
(2026-07-23). The migration guide is updated.
### How was this patch tested?
Pass the CIs with the updated `helm test`. I also verified manually on
Minikube with Apache Spark 4.2.0. Both `examples/pi-java25-deployment.yaml` and
`examples/pi-statefulset.yaml` with dynamic allocation fail without this PR and
succeed with it.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 5.5
Closes #930 from dongjoon-hyun/SPARK-59963.
Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
---
.../templates/tests/test-rbac.yaml | 7 +++++++
.../templates/workload-rbac.yaml | 16 ++++++++++++++++
docs/migration_guide.md | 8 ++++++++
3 files changed, 31 insertions(+)
diff --git
a/build-tools/helm/spark-kubernetes-operator/templates/tests/test-rbac.yaml
b/build-tools/helm/spark-kubernetes-operator/templates/tests/test-rbac.yaml
index 8e4dca6c..deefe934 100644
--- a/build-tools/helm/spark-kubernetes-operator/templates/tests/test-rbac.yaml
+++ b/build-tools/helm/spark-kubernetes-operator/templates/tests/test-rbac.yaml
@@ -138,6 +138,13 @@ spec:
kubectl auth can-i create persistentvolumeclaims --namespace={{
.Release.Namespace }}
kubectl auth can-i watch statefulsets.apps --namespace={{
.Release.Namespace }}
kubectl auth can-i create statefulsets.apps --namespace={{
.Release.Namespace }}
+ kubectl auth can-i get deployments.apps --namespace={{
.Release.Namespace }}
+ kubectl auth can-i create deployments.apps --namespace={{
.Release.Namespace }}
+ kubectl auth can-i delete deployments.apps --namespace={{
.Release.Namespace }}
+ kubectl auth can-i get statefulsets.apps --subresource=scale
--namespace={{ .Release.Namespace }}
+ kubectl auth can-i update statefulsets.apps --subresource=scale
--namespace={{ .Release.Namespace }}
+ kubectl auth can-i get deployments.apps --subresource=scale
--namespace={{ .Release.Namespace }}
+ kubectl auth can-i update deployments.apps --subresource=scale
--namespace={{ .Release.Namespace }}
# Spark workloads must not reach beyond their own namespace. `set -e`
# ignores a failing `!` pipeline, so assert each denial explicitly.
diff --git
a/build-tools/helm/spark-kubernetes-operator/templates/workload-rbac.yaml
b/build-tools/helm/spark-kubernetes-operator/templates/workload-rbac.yaml
index 6e5cdcd5..213a506e 100644
--- a/build-tools/helm/spark-kubernetes-operator/templates/workload-rbac.yaml
+++ b/build-tools/helm/spark-kubernetes-operator/templates/workload-rbac.yaml
@@ -45,6 +45,22 @@ rules:
- update
- patch
- delete
+ - apiGroups:
+ - "apps"
+ resources:
+ - deployments
+ verbs:
+ - get
+ - create
+ - delete
+ - apiGroups:
+ - "apps"
+ resources:
+ - statefulsets/scale
+ - deployments/scale
+ verbs:
+ - get
+ - update
{{- end }}
{{/*
diff --git a/docs/migration_guide.md b/docs/migration_guide.md
index 54b834ce..2b19793c 100644
--- a/docs/migration_guide.md
+++ b/docs/migration_guide.md
@@ -65,6 +65,14 @@ affect building the project, CI, tests or examples.
`events`, which are the verbs the operator uses. 1.0 also granted `list`,
`watch`, `update` and
`delete`. If other workloads use the operator ServiceAccount and need them,
grant them with
another Role or ClusterRole
([SPARK-59587](https://issues.apache.org/jira/browse/SPARK-59587)).
+- Since 1.1.0, the workload ClusterRole and Roles also grant `get`, `create`
and `delete` on
+ `deployments` in the `apps` API group, and `get` and `update` on the `scale`
subresource of
+ `statefulsets` and `deployments`. Spark drivers need them for
+ `spark.kubernetes.allocation.pods.allocator=deployment` of Spark 4.2.0 or
newer, and to scale
+ the executor StatefulSet or Deployment, e.g. with dynamic allocation. With
1.0, such a driver
+ failed to start, since creating the Deployment or scaling the StatefulSet
was forbidden. To keep
+ the rules of 1.0, set `workloadResources.clusterRole.create` and
`workloadResources.role.create`
+ to `false`, and grant them with your own Role or ClusterRole.
- Since 1.1.0, each option of
`operatorDeployment.operatorPod.operatorContainer.jvmArgs` is passed
to the operator JVM as its own argument. 1.0 passed the whole value as one
argument, which the
JVM took as a single `-Dfile.encoding` system property, so the other options
had no effect. The
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
