shrirangmhalgi commented on code in PR #57387: URL: https://github.com/apache/spark/pull/57387#discussion_r3627526537
########## core/src/main/scala/org/apache/spark/deploy/security/UserCredentialManager.scala: ########## @@ -0,0 +1,433 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.spark.deploy.security + +import java.io.{ByteArrayOutputStream, ObjectInputFilter, ObjectInputStream, ObjectOutputStream} +import java.net.URI +import java.nio.file.Paths +import java.time.Instant +import java.util.concurrent.{RejectedExecutionException, ScheduledExecutorService, TimeUnit} +import java.util.concurrent.atomic.AtomicInteger + +import scala.collection.mutable +import scala.jdk.CollectionConverters._ + +import org.apache.spark.SparkConf +import org.apache.spark.internal.Logging +import org.apache.spark.internal.LogKeys +import org.apache.spark.internal.config._ +import org.apache.spark.security._ +import org.apache.spark.ui.UIUtils +import org.apache.spark.util.ThreadUtils + +/** + * Manager for OIDC-based credential propagation on the driver. + * + * This class is a sibling of [[HadoopDelegationTokenManager]] and handles the OIDC credential + * propagation path independently. Both managers run on independent threads and can both be + * active simultaneously (e.g., a cluster accessing HDFS via Kerberos and S3 via OIDC). + * + * Responsibilities: + * 1. Reads the current identity token via a [[TokenIngestor]] + * 2. Calls [[CredentialProvider#resolve]] for each configured scheme + * 3. Serializes the resulting [[UserCredentials]] and invokes the propagation callback + * 4. Schedules renewal based on `min(identity token expiry, service credential expiry) - + * safetyMargin` + * 5. Retries with exponential backoff on failure + * + * Started from `CoarseGrainedSchedulerBackend.start()` when + * `spark.security.credentials.enabled=true`, independently of + * `UserGroupInformation.isSecurityEnabled()`. + * + * Lifecycle: call `start()` exactly once, then `stop()` to shut down. + * Calling `start()` after `stop()` is not supported. + */ +private[spark] class UserCredentialManager( + sparkConf: SparkConf, + tokenIngestor: TokenIngestor, + onCredentialsUpdate: Array[Byte] => Unit) extends Logging { + + private val safetyMargin = sparkConf.get(SECURITY_CREDENTIALS_RENEWAL_SAFETY_MARGIN) + private val minInterval = sparkConf.get(SECURITY_CREDENTIALS_RENEWAL_MIN_INTERVAL) + + // Thread-safe counter for exponential backoff calculation. + // Accessed from both the caller of start() and the scheduled renewal thread. + private val consecutiveFailures = new AtomicInteger(0) + private val maxBackoffMs: Long = TimeUnit.MINUTES.toMillis(10) + + @volatile private var renewalExecutor: ScheduledExecutorService = _ + + // Pre-compute the filtered credential configuration map (SparkConf is immutable). + private val credentialConfMap: java.util.Map[String, String] = sparkConf.getAll + .filter(_._1.startsWith("spark.security.credentials.")) + .toMap.asJava + + /** + * Start the credential manager. Acquires initial credentials and schedules renewal. + * + * The initial credential acquisition is fail-fast: if the token cannot be loaded or + * no credentials can be resolved, an exception is thrown. Subsequent renewal failures + * are handled with exponential backoff. + * + * @return The serialized initial [[UserCredentials]]. + * @throws IllegalStateException if the initial credential acquisition fails. + */ + def start(): Array[Byte] = { + require(renewalExecutor == null, "start() must not be called more than once") + renewalExecutor = + ThreadUtils.newDaemonSingleThreadScheduledExecutor("user-credential-renewal") + + // Initial acquisition is fail-fast (no retry/backoff). + // This ensures the application fails to start if credentials cannot be obtained, + // rather than running with null credentials. + val userContext = tokenIngestor.load() + if (!userContext.isPresent) { + throw new IllegalStateException( + "Failed to start UserCredentialManager: identity token file is missing or malformed. " + + s"Check ${SECURITY_CREDENTIALS_IDENTITY_TOKEN_FILE.key} configuration.") + } + + val ctx = userContext.get() + logInfo(log"Initial identity token loaded for principal " + + log"${MDC(LogKeys.PRINCIPAL, ctx.getPrincipal)} " + + log"(issuer: ${MDC(LogKeys.URI, ctx.getIssuer)})") + + val (credentials, earliestExpiry) = resolveCredentials(ctx) + val serialized = serializeUserCredentials(credentials) + + // Propagate initial credentials + onCredentialsUpdate(serialized) + + // Schedule first renewal + val renewalDelay = computeRenewalDelay(ctx, earliestExpiry) + scheduleRenewal(renewalDelay) + + logInfo(log"Credential acquisition successful. Next renewal in " + + log"${MDC(LogKeys.TIME_UNITS, UIUtils.formatDuration(renewalDelay))}.") + serialized + } + + def stop(): Unit = { + if (renewalExecutor != null) { + renewalExecutor.shutdownNow() + } + } + + /** + * Scheduled renewal task: load identity token, resolve credentials, propagate, + * and schedule the next renewal. Failures are retried with exponential backoff. + */ + private def renewCredentialsTask(): Unit = { + try { + val userContext = tokenIngestor.load() Review Comment: (non-blocking): `tokenIngestor.load()` here does `Files.readAllBytes` on the renewal thread with no timeout. In Kubernetes environments with projected service account tokens, the token volume can become temporarily unresponsive under kubelet pressure - blocking the single renewal thread indefinitely and causing credentials to go stale with no retry path. HDTM has the same pattern (no timeout on `checkTGTAndReloginFromKeytab`), but OIDC deployments are more likely to use network-mounted token files (FUSE, CSI drivers) than Kerberos keytabs. Would a `Future`-based timeout be worth tracking as a follow-up? ########## core/src/main/scala/org/apache/spark/deploy/security/UserCredentialManager.scala: ########## @@ -0,0 +1,433 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.spark.deploy.security + +import java.io.{ByteArrayOutputStream, ObjectInputFilter, ObjectInputStream, ObjectOutputStream} +import java.net.URI +import java.nio.file.Paths +import java.time.Instant +import java.util.concurrent.{RejectedExecutionException, ScheduledExecutorService, TimeUnit} +import java.util.concurrent.atomic.AtomicInteger + +import scala.collection.mutable +import scala.jdk.CollectionConverters._ + +import org.apache.spark.SparkConf +import org.apache.spark.internal.Logging +import org.apache.spark.internal.LogKeys +import org.apache.spark.internal.config._ +import org.apache.spark.security._ +import org.apache.spark.ui.UIUtils +import org.apache.spark.util.ThreadUtils + +/** + * Manager for OIDC-based credential propagation on the driver. + * + * This class is a sibling of [[HadoopDelegationTokenManager]] and handles the OIDC credential + * propagation path independently. Both managers run on independent threads and can both be + * active simultaneously (e.g., a cluster accessing HDFS via Kerberos and S3 via OIDC). + * + * Responsibilities: + * 1. Reads the current identity token via a [[TokenIngestor]] + * 2. Calls [[CredentialProvider#resolve]] for each configured scheme + * 3. Serializes the resulting [[UserCredentials]] and invokes the propagation callback + * 4. Schedules renewal based on `min(identity token expiry, service credential expiry) - + * safetyMargin` + * 5. Retries with exponential backoff on failure + * + * Started from `CoarseGrainedSchedulerBackend.start()` when + * `spark.security.credentials.enabled=true`, independently of + * `UserGroupInformation.isSecurityEnabled()`. + * + * Lifecycle: call `start()` exactly once, then `stop()` to shut down. + * Calling `start()` after `stop()` is not supported. + */ +private[spark] class UserCredentialManager( + sparkConf: SparkConf, + tokenIngestor: TokenIngestor, + onCredentialsUpdate: Array[Byte] => Unit) extends Logging { + + private val safetyMargin = sparkConf.get(SECURITY_CREDENTIALS_RENEWAL_SAFETY_MARGIN) + private val minInterval = sparkConf.get(SECURITY_CREDENTIALS_RENEWAL_MIN_INTERVAL) + + // Thread-safe counter for exponential backoff calculation. + // Accessed from both the caller of start() and the scheduled renewal thread. + private val consecutiveFailures = new AtomicInteger(0) + private val maxBackoffMs: Long = TimeUnit.MINUTES.toMillis(10) + + @volatile private var renewalExecutor: ScheduledExecutorService = _ + + // Pre-compute the filtered credential configuration map (SparkConf is immutable). + private val credentialConfMap: java.util.Map[String, String] = sparkConf.getAll + .filter(_._1.startsWith("spark.security.credentials.")) + .toMap.asJava + + /** + * Start the credential manager. Acquires initial credentials and schedules renewal. + * + * The initial credential acquisition is fail-fast: if the token cannot be loaded or + * no credentials can be resolved, an exception is thrown. Subsequent renewal failures + * are handled with exponential backoff. + * + * @return The serialized initial [[UserCredentials]]. + * @throws IllegalStateException if the initial credential acquisition fails. + */ + def start(): Array[Byte] = { + require(renewalExecutor == null, "start() must not be called more than once") + renewalExecutor = + ThreadUtils.newDaemonSingleThreadScheduledExecutor("user-credential-renewal") + + // Initial acquisition is fail-fast (no retry/backoff). + // This ensures the application fails to start if credentials cannot be obtained, + // rather than running with null credentials. + val userContext = tokenIngestor.load() + if (!userContext.isPresent) { + throw new IllegalStateException( + "Failed to start UserCredentialManager: identity token file is missing or malformed. " + + s"Check ${SECURITY_CREDENTIALS_IDENTITY_TOKEN_FILE.key} configuration.") + } + + val ctx = userContext.get() + logInfo(log"Initial identity token loaded for principal " + + log"${MDC(LogKeys.PRINCIPAL, ctx.getPrincipal)} " + + log"(issuer: ${MDC(LogKeys.URI, ctx.getIssuer)})") + + val (credentials, earliestExpiry) = resolveCredentials(ctx) + val serialized = serializeUserCredentials(credentials) + + // Propagate initial credentials + onCredentialsUpdate(serialized) + + // Schedule first renewal + val renewalDelay = computeRenewalDelay(ctx, earliestExpiry) + scheduleRenewal(renewalDelay) + + logInfo(log"Credential acquisition successful. Next renewal in " + + log"${MDC(LogKeys.TIME_UNITS, UIUtils.formatDuration(renewalDelay))}.") + serialized + } + + def stop(): Unit = { + if (renewalExecutor != null) { + renewalExecutor.shutdownNow() + } + } + + /** + * Scheduled renewal task: load identity token, resolve credentials, propagate, + * and schedule the next renewal. Failures are retried with exponential backoff. + */ + private def renewCredentialsTask(): Unit = { + try { + val userContext = tokenIngestor.load() + if (!userContext.isPresent) { + throw new IllegalStateException( + "TokenIngestor returned empty - identity token file may be missing or malformed") + } + + val ctx = userContext.get() + logInfo(log"Loaded identity token for principal " + + log"${MDC(LogKeys.PRINCIPAL, ctx.getPrincipal)} " + + log"(issuer: ${MDC(LogKeys.URI, ctx.getIssuer)})") + + val (credentials, earliestExpiry) = resolveCredentials(ctx) + val serialized = serializeUserCredentials(credentials) + + // Propagate credentials to executors. Errors here are logged separately + // so that credential-fetch success is not conflated with distribution failure. + try { + onCredentialsUpdate(serialized) + } catch { + case e: Exception => + logWarning(log"Credentials were resolved successfully but failed to propagate " + + log"to executors. Executors will receive updated credentials on next renewal.", e) + } + + // Reset backoff on successful credential resolution. This is intentionally done + // even if onCredentialsUpdate failed above: the backoff counter tracks credential + // *resolution* failures (STS/provider issues), not propagation failures. + // Propagation failures are transient and will be retried on next scheduled renewal. + consecutiveFailures.set(0) Review Comment: nit (non-blocking): When `onCredentialsUpdate` throws here, `consecutiveFailures` is reset to 0 and the next renewal is at the full scheduled interval. This means executors could run with stale credentials for the entire renewal period even though fresh credentials are already resolved and sitting in memory. Would a faster propagation-only retry (shorter delay, skip `tokenIngestor.load()` + `resolveCredentials()`) be worth adding for the case where resolution succeeds but distribution fails? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
