alexandrefimov commented on PR #1: URL: https://github.com/apache/spark-connect-gateway/pull/1#issuecomment-5338756595
The routing crate landing gives the user-aware placement piece a home, and I have it ready against `main`: an `OwnerLabelStrategy` that matches `SessionKey::user_id` against an owner label on `BackendMember`, rotates within the subset one user owns, and declines instead of placing the session when `user_id` is empty or no member carries a matching label. `cargo test --workspace` is 21/21 with clippy and fmt clean. It fails closed rather than falling back to round-robin because a wrong placement is not an affinity miss. Spark Connect never uses `user_id` as the execution identity — the plan runs as the process user of the driver it lands on. On 4.0.3 with a Ranger-enabled Kyuubi engine started as `testalice`, a client claiming `user_id=bob` is denied with "user [testalice] does not have [create] privilege": the backend authorizes as its owner, whatever the client says it is. This is the strategy half only. The other half — labels reaching the pool from discovery — has nothing to attach to yet, since `scg-pool-k8s` surfaces addresses only. I can't create a SPARK sub-task myself. Could you file one under SPARK-58455 whenever it fits your import order, or point me at a better venue for the patch? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
