sunchao commented on code in PR #57350: URL: https://github.com/apache/spark/pull/57350#discussion_r3610770437
########## resource-managers/kubernetes/core/src/main/scala/org/apache/spark/deploy/k8s/features/DriverUIServiceFeatureStep.scala: ########## @@ -0,0 +1,108 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.spark.deploy.k8s.features + +import scala.jdk.CollectionConverters._ + +import io.fabric8.kubernetes.api.model.{HasMetadata, ServiceBuilder} + +import org.apache.spark.deploy.k8s.{KubernetesDriverConf, SparkPod} +import org.apache.spark.deploy.k8s.Config.{ + KUBERNETES_DRIVER_UI_SERVICE_ENABLED, + KUBERNETES_DRIVER_UI_SERVICE_NAME, + KUBERNETES_DRIVER_UI_SERVICE_TYPE +} +import org.apache.spark.deploy.k8s.Constants._ +import org.apache.spark.internal.{config, Logging} + +/** + * Optionally provisions a dedicated Kubernetes Service exposing only the Spark driver's Web UI + * port. + * + * At creation time, the Service's `targetPort` is set to the configured `spark.ui.port` + * (a placeholder when the user has requested a random port). Once the driver's Jetty server + * has bound, `K8sDriverUIServicePatcher` updates the Service's `targetPort` to reflect the + * actual bound port. + */ +private[spark] class DriverUIServiceFeatureStep(kubernetesConf: KubernetesDriverConf) + extends KubernetesFeatureConfigStep with Logging { + import DriverUIServiceFeatureStep._ + + private val enabled = kubernetesConf.get(KUBERNETES_DRIVER_UI_SERVICE_ENABLED) + private lazy val serviceType = kubernetesConf.get(KUBERNETES_DRIVER_UI_SERVICE_TYPE) + private lazy val configuredUIPort = kubernetesConf.get(config.UI.UI_PORT) + + /** + * Port value used when building the Service. When the user has requested a random UI port + * (`spark.ui.port=0`), the actual port is only known after the driver's Jetty server binds, + * so we substitute the default UI port (typically 4040) purely as a placeholder to satisfy + * Kubernetes' Service port validation (must be > 0). After the driver JVM starts, + * [[org.apache.spark.scheduler.cluster.k8s.K8sDriverUIServicePatcher]] updates the Service's + * `targetPort` to the real bound port. + */ + private lazy val servicePort: Int = if (configuredUIPort == 0) { Review Comment: [P1] Handle port zero in the existing driver resources too This placeholder only fixes the new dedicated Service. With `spark.ui.port=0`, `BasicDriverFeatureStep` still emits `containerPort=0`, and `DriverServiceFeatureStep` still emits `port=0` / `targetPort=0` for the mandatory headless Service. Kubernetes requires these numeric ports to be in `1..65535`, so the driver Pod/resources are rejected before this runtime patch can run. Please omit or substitute both existing UI port declarations and cover the complete `KubernetesDriverBuilder` output in a test. ########## resource-managers/kubernetes/core/src/main/scala/org/apache/spark/deploy/k8s/Config.scala: ########## @@ -100,6 +100,36 @@ private[spark] object Config extends Logging { .booleanConf .createWithDefault(false) + val KUBERNETES_DRIVER_UI_SERVICE_ENABLED = + ConfigBuilder("spark.kubernetes.driver.ui.service.enabled") + .doc("If true, Spark will create a dedicated Kubernetes Service for the Spark driver " + + "Web UI (separate from the headless driver service). When enabled, after the driver " + + "Web UI starts, Spark will patch the Service's targetPort to match the actual bound " + + "UI port, which allows using `spark.ui.port=0` (random port). Requires the driver's " + + "ServiceAccount to have `patch services` permission.") Review Comment: [P2] Include GET in the required RBAC permissions The patcher calls `get()` before `patch()`, and Kubernetes RBAC verbs are independent. A least-privilege role granting only the documented `patch` verb receives a 403 on the GET; the exception is rethrown from backend startup and aborts `SparkContext` initialization. Please document both `get` and `patch`, or issue a targeted patch that does not require the preliminary read. ########## resource-managers/kubernetes/core/src/main/scala/org/apache/spark/scheduler/cluster/k8s/KubernetesClusterSchedulerBackend.scala: ########## @@ -120,6 +121,27 @@ private[spark] class KubernetesClusterSchedulerBackend( if (!conf.get(KUBERNETES_EXECUTOR_DISABLE_CONFIGMAP)) { setUpExecutorConfigMap(podAllocator.driverPod) } + maybePatchDriverUIServiceTargetPort() Review Comment: [P2] Patch the Service in driver-only mode too `spark.kubernetes.driver.master=local[*]` is a supported driver-only mode, but `KubernetesClusterManager` returns `LocalSchedulerBackend` for it, so this method never runs even though `DriverUIServiceFeatureStep` still creates the Service. After the zero-port manifest issue is fixed, the UI binds randomly while `targetPort` remains at the placeholder; a nonzero bind collision produces the same stale target. Please move this hook to a driver lifecycle shared by both backends, or explicitly reject/disable the feature in driver-only mode. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
