Kousuke Saruta created SPARK-57893:
--------------------------------------
Summary: Implement UserCredentialManager
Key: SPARK-57893
URL: https://issues.apache.org/jira/browse/SPARK-57893
Project: Spark
Issue Type: Sub-task
Components: Spark Core
Affects Versions: 4.3.0
Reporter: Kousuke Saruta
This sub-task is part of the umbrella
[SPARK-57703|https://issues.apache.org/jira/browse/SPARK-57703] (OIDC
Credential Propagation).
h2. Problem
There is no component to orchestrate credential acquisition, renewal
scheduling, and propagation triggering on the driver.
h2. Goal
Introduce {{UserCredentialManager}} that coordinates {{TokenIngestor}} and
{{CredentialProvider}} to maintain fresh credentials and notify the backend
when credentials are updated.
h2. Scope
* Lives in {{org.apache.spark.deploy.security}}, as a sibling of
{{HadoopDelegationTokenManager}}
* Started from {{CoarseGrainedSchedulerBackend.start()}} when
{{spark.security.credentials.enabled=true}}
* Responsibilities:
*# Pull current {{UserContext}} via {{TokenIngestor.load()}}
*# Call {{CredentialProvider.resolve()}} for each configured scheme
*# Schedule next renewal based on {{min(identity token expiry, service
credential expiry) - safetyMargin}}
*# Retry with exponential backoff on failure
*# Invoke callback to propagate updated credentials
* Configuration: {{spark.security.credentials.renewal.safetyMargin}},
{{spark.security.credentials.renewal.minInterval}}
h2. Acceptance criteria
* Manager starts, acquires initial credentials, and invokes the propagation
callback.
* Renewal is scheduled at the correct time (before expiry minus safety margin).
* On {{TokenIngestor}} rotation, new credentials are acquired and propagated.
* On failure, exponential backoff is applied.
* {{HadoopDelegationTokenManager}} is unaffected (no code changes, coexists
independently).
* Unit tests with mocked TokenIngestor and FakeCredentialProvider.
Reference: [SPIP design document Appendix
B|https://docs.google.com/document/d/1usJKncCPMiyFUg7aIdpZ0HQsklXIHow_sU_6dfFMjN0/edit].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
