André Schaidhauer Luckmann created SPARK-58622:
--------------------------------------------------
Summary: Support server-side TLS for the Spark Connect gRPC server
Key: SPARK-58622
URL: https://issues.apache.org/jira/browse/SPARK-58622
Project: Spark
Issue Type: Improvement
Components: Connect
Affects Versions: 5.0.0
Reporter: André Schaidhauer Luckmann
## What
Enable Spark Connect's gRPC server to terminate TLS directly, instead of
requiring an external reverse-proxy sidecar. Configuration is read from the
standard `spark.ssl.connect.*` namespace (parsed via
SSLOptions, same machinery as `spark.ssl.ui`, `spark.ssl.rpc`).
## Why
Today an operator wanting TLS between a Connect client and the Connect server
must front the gRPC endpoint with an Envoy/nginx/haproxy sidecar configured for
HTTP/2. This is operationally awkward and duplicates
configuration a native Spark deployment already has. The Connect Python and
Scala clients have supported use_ssl since SPARK-42533 (3.4.1); the server side
has been the gap.
## Scope
- Server-side TLS only. mTLS is a follow-up.
- PEM key material only in this PR. JKS + provider overrides are follow-ups.
- spark.ssl.connect.enabled is opt-in and does not inherit spark.ssl.enabled
(matches spark.ssl.rpc.enabled precedent).
## Related
- SPARK-41917 (client-focused, still open)
- SPARK-42533 (Scala client SSL, merged)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
