[
https://issues.apache.org/jira/browse/SPARK-58926?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chandni Singh updated SPARK-58926:
----------------------------------
Description:
BasicDriverFeatureStep stamps SPARK_USER on the driver container from
Utils.getCurrentUserName(), ignoring conf.proxyUser. This produces the wrong
identity in two cases:
1. bin/spark-submit --proxy-user alice on Kubernetes. SparkSubmit wraps runMain
in proxyUser.doAs(...), but Utils.getCurrentUserName() reads the SPARK_USER
environment variable before falling back to the UGI short user name. If the
launcher shell has SPARK_USER exported (as is common on managed clusters and
inside Docker images that set it during build), the env value wins and doAs
never gets a chance to matter. The driver container ends up with the env-var
value, not alice.
2. Spark Kubernetes Operator. The operator builds the driver pod by invoking
the feature steps directly, with no equivalent doAs, so the driver's SPARK_USER
is the operator's identity rather than the proxy user. This was originally
filed as SPARK-58926 in that form; the SKO-side workaround was pursued in
apache/spark-kubernetes-operator#803 but is neither necessary nor sufficient
(see PR discussion).
was: When the Spark Kubernetes Operator submits an application with a proxy
user configured (e.g. spark.kubernetes.driver.proxyUser=alice, or equivalent CR
field), the driver pod's SPARK_USER environment variable is still set to the
submitter (e.g. spark) rather than the proxy user (alice).
> Driver pod SPARK_USER should reflect --proxy-user when set
> ----------------------------------------------------------
>
> Key: SPARK-58926
> URL: https://issues.apache.org/jira/browse/SPARK-58926
> Project: Spark
> Issue Type: Sub-task
> Components: Kubernetes
> Affects Versions: kubernetes-operator-1.1.0
> Reporter: Chandni Singh
> Priority: Major
> Labels: pull-request-available
>
> BasicDriverFeatureStep stamps SPARK_USER on the driver container from
> Utils.getCurrentUserName(), ignoring conf.proxyUser. This produces the wrong
> identity in two cases:
> 1. bin/spark-submit --proxy-user alice on Kubernetes. SparkSubmit wraps
> runMain in proxyUser.doAs(...), but Utils.getCurrentUserName() reads the
> SPARK_USER environment variable before falling back to the UGI short user
> name. If the launcher shell has SPARK_USER exported (as is common on managed
> clusters and inside Docker images that set it during build), the env value
> wins and doAs never gets a chance to matter. The driver container ends up
> with the env-var value, not alice.
> 2. Spark Kubernetes Operator. The operator builds the driver pod by invoking
> the feature steps directly, with no equivalent doAs, so the driver's
> SPARK_USER is the operator's identity rather than the proxy user. This was
> originally filed as SPARK-58926 in that form; the SKO-side workaround was
> pursued in apache/spark-kubernetes-operator#803 but is neither necessary nor
> sufficient (see PR discussion).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
