Kalvin2077 opened a new pull request, #3857: URL: https://github.com/apache/celeborn/pull/3857
## What changes were proposed in this pull request? This PR adds transport security extension points so downstream deployments can plug custom authentication and authorization into Celeborn without forking the transport layer. - Add configurable `TransportClientBootstrap` and `TransportServerBootstrap` loading per transport module. - Add connection-local `ApplicationAuthorizer` and `ServiceAuthorizer`. - Propagate verified `UserIdentifier` into Master quota and Worker resource ownership. - Adjust client-side transport initialization to wait for LifecycleManager credentials. ## Why are the changes needed? Current authentication is tightly coupled to the native SASL/application-ID model. Downstream systems need to compose their own credential verification, tenant policy, and service-role policy with Celeborn without modifying core transport code. ## Does this PR resolve a correctness bug? - [ ] Yes ## Does this PR introduce any user-facing change? - [x] Yes Adds new extension interfaces and configuration keys. Default behavior remains unchanged when no external bootstrap is configured. ## How was this patch tested? - `TransportBootstrapSuiteJ` - `ExternalAuthenticationSuiteJ` - `RpcEndpointSecuritySuite` - `MasterSecuritySuite` - `ControllerSecuritySuite` - `AuthenticatedShuffleSuite` - Flink direct JUnit tests -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
