aicam opened a new pull request, #6866: URL: https://github.com/apache/texera/pull/6866
### What changes were proposed in this PR? Perform the FUSE mount for dataset repositories **outside** the (unprivileged) computing-unit pod — the infrastructure foundation of the dataset-mounting feature (#6606). - **`texera-mounter` DaemonSet** — a per-node privileged agent (`bin/mounter/mounter.py` + tests, dockerfile, helm daemonset/rbac/values) that runs GeeseFS on a pod's behalf. The read-only mount is exposed back into the CU pod via Kubernetes **mount propagation**, scoped to that computing unit, so the pod that runs untrusted user code stays **unprivileged**. - **Unprivileged CU pod wiring** (`KubernetesClient`) — the propagation volume + node-IP / mounter env. - **File-service JWT S3 proxy** (`S3ProxyServlet`) — fronts the LakeFS S3 gateway: verifies the pod's JWT, checks the user's read access, and re-signs to LakeFS with credentials held only server-side. No global credential ever enters the pod. Foundation only — nothing triggers a mount yet; the platform integration (engine client + per-CU mount API + UI + UDF bindings) comes in the follow-up PR. ### Any related issues, documentation, discussions? Closes #6862 · part of #6606. ### How was this PR tested? `sbt FileService/compile ComputingUnitManagingService/compile` green. The mounter has its own pytest suite (`bin/mounter/tests`). The whole feature (this PR + the integration follow-up) was validated end-to-end on minikube: a Python UDF read a ~2 GB sharded PyTorch model from a propagated mount via `torch.load`, bit-exact; the mounter's reaper/unmount and the proxy's JWT authorization (positive + negative) were exercised. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Opus 4.8 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
