dongjoon-hyun commented on code in PR #57387:
URL: https://github.com/apache/spark/pull/57387#discussion_r3666910656
##########
core/src/main/scala/org/apache/spark/internal/config/package.scala:
##########
@@ -1690,6 +1690,46 @@ package object config {
.timeConf(TimeUnit.SECONDS)
.createWithDefaultString("1h")
+ private[spark] val SECURITY_CREDENTIALS_ENABLED =
+ ConfigBuilder("spark.security.oidc.enabled")
+ .doc("Whether to enable OIDC credential propagation. When enabled, the
driver reads an " +
+ "identity token from a file, exchanges it for short-lived service
credentials via " +
+ "CredentialProvider implementations, and propagates those credentials
to executors.")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .booleanConf
+ .createWithDefault(false)
+
+ private[spark] val SECURITY_CREDENTIALS_IDENTITY_TOKEN_FILE =
+ ConfigBuilder("spark.security.oidc.identityToken.file")
+ .doc("Path to the OIDC identity token file on the driver. Required when
" +
+ "spark.security.oidc.enabled is true. The file should contain a JWT
token " +
+ "(e.g., a Kubernetes projected service account token).")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .stringConf
+ .createOptional
+
+ private[spark] val SECURITY_CREDENTIALS_RENEWAL_SAFETY_MARGIN =
+ ConfigBuilder("spark.security.oidc.renewal.safetyMargin")
+ .doc("How long before credential expiry to trigger renewal. Credentials
are refreshed " +
+ "at min(identity token expiry, service credential expiry) minus this
margin.")
+ .version("4.3.0")
+ .withBindingPolicy(ConfigBindingPolicy.NOT_APPLICABLE)
+ .timeConf(TimeUnit.MILLISECONDS)
+ .checkValue(_ > 0, "The safety margin must be a positive time value.")
+ .createWithDefaultString("60s")
+
+ private[spark] val SECURITY_CREDENTIALS_RENEWAL_MIN_INTERVAL =
Review Comment:
```suggestion
private[spark] val SECURITY_OIDC_RENEWAL_MIN_INTERVAL =
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
