dongjoon-hyun commented on code in PR #57387:
URL: https://github.com/apache/spark/pull/57387#discussion_r3650916705
##########
core/src/main/scala/org/apache/spark/internal/config/package.scala:
##########
@@ -1679,6 +1679,44 @@ package object config {
.timeConf(TimeUnit.SECONDS)
.createWithDefaultString("1h")
+ private[spark] val SECURITY_CREDENTIALS_ENABLED =
+ ConfigBuilder("spark.security.credentials.enabled")
+ .doc("Whether to enable OIDC credential propagation. When enabled, the
driver reads an " +
+ "identity token from a file, exchanges it for short-lived service
credentials via " +
+ "CredentialProvider implementations, and propagates those credentials
to executors.")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .booleanConf
+ .createWithDefault(false)
+
+ private[spark] val SECURITY_CREDENTIALS_IDENTITY_TOKEN_FILE =
+ ConfigBuilder("spark.security.credentials.identityToken.file")
+ .doc("Path to the OIDC identity token file on the driver. Required when
" +
+ "spark.security.credentials.enabled is true. The file should contain a
JWT token " +
+ "(e.g., a Kubernetes projected service account token).")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .stringConf
+ .createOptional
+
+ private[spark] val SECURITY_CREDENTIALS_RENEWAL_SAFETY_MARGIN =
+ ConfigBuilder("spark.security.credentials.renewal.safetyMargin")
+ .doc("How long before credential expiry to trigger renewal. Credentials
are refreshed " +
+ "at min(identity token expiry, service credential expiry) minus this
margin.")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .timeConf(TimeUnit.MILLISECONDS)
+ .createWithDefaultString("60s")
+
+ private[spark] val SECURITY_CREDENTIALS_RENEWAL_MIN_INTERVAL =
+ ConfigBuilder("spark.security.credentials.renewal.minInterval")
+ .doc("Minimum interval between credential renewal attempts. This
prevents tight renewal " +
+ "loops when credentials have very short TTLs or when failures cause
rapid retries.")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .timeConf(TimeUnit.MILLISECONDS)
+ .createWithDefaultString("30s")
Review Comment:
`computeBackoffDelay()` uses `minInterval` as the base of the exponential
backoff, and `computeRenewalDelay()` uses it as the lower bound of the renewal
delay. If a user sets this to `0`, both can return `0ms`, so a persistent
resolution failure (or an already-expired token) degenerates into a tight retry
loop that hammers the token file and the credential providers with no delay.
Rejecting non-positive values at config time prevents this.
```suggestion
.checkValue(_ > 0, "The minimum renewal interval must be a positive
time value.")
.createWithDefaultString("30s")
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
