[
https://issues.apache.org/jira/browse/SPARK-58926?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chandni Singh updated SPARK-58926:
----------------------------------
Description: When the Spark Kubernetes Operator submits an application
with a proxy user configured (e.g. spark.kubernetes.driver.proxyUser=alice, or
equivalent CR field), the driver pod's SPARK_USER environment variable is still
set to the submitter (e.g. spark) rather than the proxy user (alice). (was:
When a Spark app is submitted on Kubernetes with --proxy-user alice, the driver
pod's SPARK_USER env var is set to the submitter (e.g. spark), not alice.
Anything in the driver JVM that reads SPARK_USER sees the wrong identity. That
includes SparkContext.sparkUser (event log ownership, UI attribution) and Spark
UI view/modify ACLs (SecurityManager). External authz systems (Ranger, custom
gRPC interceptors) that resolve identity through SPARK_USER inherit the same
wrong value.)
> Driver pod SPARK_USER should reflect --proxy-user when set
> ----------------------------------------------------------
>
> Key: SPARK-58926
> URL: https://issues.apache.org/jira/browse/SPARK-58926
> Project: Spark
> Issue Type: Bug
> Components: Kubernetes
> Affects Versions: 4.2.0
> Reporter: Chandni Singh
> Priority: Major
> Labels: pull-request-available
>
> When the Spark Kubernetes Operator submits an application with a proxy user
> configured (e.g. spark.kubernetes.driver.proxyUser=alice, or equivalent CR
> field), the driver pod's SPARK_USER environment variable is still set to the
> submitter (e.g. spark) rather than the proxy user (alice).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
