wangyum commented on code in PR #57525:
URL: https://github.com/apache/spark/pull/57525#discussion_r3713378185
##########
core/src/main/scala/org/apache/spark/scheduler/cluster/CoarseGrainedSchedulerBackend.scala:
##########
@@ -353,14 +393,37 @@ class CoarseGrainedSchedulerBackend(scheduler:
TaskSchedulerImpl, val rpcEnv: Rp
triggeredByExecutor = true))
case RetrieveSparkAppConfig(resourceProfileId) =>
- val rp =
scheduler.sc.resourceProfileManager.resourceProfileFromId(resourceProfileId)
- val reply = SparkAppConfig(
- sparkProperties,
- SparkEnv.get.securityManager.getIOEncryptionKey(),
- Option(delegationTokens.get()),
- rp,
- currentLogLevel)
- context.reply(reply)
+ if (!SparkEnv.get.securityManager.isAuthenticationEnabled()) {
+ // External callers that still use the original one-field message do
+ // not supply an appId for validation. Only return credentials (I/O
+ // encryption key, delegation tokens) when RPC authentication is
+ // enabled -- otherwise the identity is unverifiable and credential
+ // disclosure to a wrong driver is possible.
+ context.sendFailure(new SparkException("Executor did not supply an
application ID " +
+ "and RPC authentication is not enabled (spark.authenticate=false).
" +
+ "RPC authentication must be enabled for this legacy request."))
+ } else {
+ replySparkAppConfig(resourceProfileId, context)
Review Comment:
We use a UUID here instead of an appid, which makes things much more
convenient:
https://github.com/apache/spark/blob/ec2ba8cc33f022e8d552d85d0a37a1b193b90d06/core/src/main/scala/org/apache/spark/scheduler/cluster/CoarseGrainedSchedulerBackend.scala#L66-L70
##########
core/src/main/scala/org/apache/spark/scheduler/cluster/CoarseGrainedSchedulerBackend.scala:
##########
@@ -140,6 +140,20 @@ class CoarseGrainedSchedulerBackend(scheduler:
TaskSchedulerImpl, val rpcEnv: Rp
ThreadUtils.newDaemonSingleThreadScheduledExecutor("cleanup-decommission-execs")
}
+ private def appIdMismatch(executorAppId: Option[String]):
Option[SparkException] = {
+ val resolvedDriverAppId = this.realApplicationId()
+ val execAppId = executorAppId.filter(_.nonEmpty)
+ (execAppId, resolvedDriverAppId) match {
+ case (Some(exec), Some(driver)) if exec != driver =>
Review Comment:
We use a UUID here instead of an appid, which makes things much more
convenient:
https://github.com/apache/spark/blob/ec2ba8cc33f022e8d552d85d0a37a1b193b90d06/core/src/main/scala/org/apache/spark/scheduler/cluster/CoarseGrainedSchedulerBackend.scala#L66-L70
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
