viirya opened a new pull request, #23:
URL: https://github.com/apache/spark-connect-gateway/pull/23
The e2e workflow covers baseline routing, JWT identity, and the backend
trust boundary, but nothing in CI exercises per-tenant backend pools. The
multi-tenant walkthrough under deploy/examples/e2e-multitenant has never
run automatically, so the chart's tenantPools.overrides templating and
the gateway's pool-isolation behaviour are only verified by hand.
This adds an e2e-multitenant job that stands up two independent Spark
Connect deployments, one per tenant, and asserts:
(1) The chart renders both tenant pool overrides plus the strict
onUnknownTenant=reject policy, and the gateway starts one Kubernetes
Endpoints watcher per override pool with no default pool at all.
(2) Two clients with JWTs claiming different tenants both succeed, and
the session.create audit events show each tenant reached only its own
backend Endpoint. This is the isolation assertion: the backend IPs are
captured from the two Services beforehand and compared exactly, so a
routing regression that sent both tenants to one pool would fail.
(3) A JWT claiming a tenant with no configured pool is rejected with
PermissionDenied, while a JWT carrying no tenant claim is rejected with
Unauthenticated. The two rejects must stay distinct: one identified
itself and was refused, the other never identified a tenant.
(4) Both rejects are observable -- the unknown tenant as an rpc.error
audit event, the missing claim as an auth.failure with
reason=missing_tenant plus its metric -- and only the two successful
sessions bound a backend.
Verified locally against a kind cluster before wiring it up: each tenant
stayed pinned to its own backend across repeated sessions, and both
reject paths returned the documented status codes and messages.
Co-authored-by: Claude Code
---
Verified locally against a kind cluster (`scg-mt`) before writing the
workflow.
Each tenant stayed pinned to its own backend across repeated sessions:
```
team-a -> ['10.244.0.5:15002']
team-b -> ['10.244.0.6:15002']
```
matching the two Services' Endpoints exactly. Both reject paths returned the
documented status codes and messages, and audit/metrics agreed (2
`session.create`, 1 `rpc.error`, 1 `auth.failure{reason=missing_tenant}`,
`scg_backend_pool_size 0` as documented for strict mode).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
