sarutak commented on code in PR #59185:
URL: https://github.com/apache/spark/pull/59185#discussion_r4163335655
##########
core/src/test/scala/org/apache/spark/deploy/security/UserCredentialManagerSuite.scala:
##########
@@ -858,4 +859,90 @@ class UserCredentialManagerSuite extends SparkFunSuite {
AnotherFakeCredentialProvider.throwOnProperties = false
}
}
+
+ // ========== RPC encryption warning ==========
+
+ private val encryptionWarningFragment = "RPC channel encryption is not
configured"
Review Comment:
Thanks, I've addressed the followings.
- The log-based tests no longer match on the exact concatenated fragment.
They now assert on a stable part: the OIDC config key
(`spark.security.oidc.enabled`) plus the `WARN` level (and the word
"encryption"), so rewording the message doesn't break them.
- Added the missing truth-table combinations: `spark.ssl.rpc.enabled`
together with auth + crypto, and `spark.ssl.rpc.enabled` with crypto only (no
auth). These pin that SSL RPC is sufficient on its own and that the auth gate
only applies to the AES/SASL path.
- Since the predicate now lives in `SecurityManager`, I moved the
truth-table tests to `SecurityManagerSuite` (next to the predicate) and kept
only the OIDC-specific wiring tests in `UserCredentialManagerSuite`. The
`HadoopDelegationTokenManager.require()` refactor stays covered by
`NonKerberosCredentialsSuite` ("fails if no RPC encryption is enabled" /
"accepts SASL encryption" / "accepts SSL RPC encryption"), which exercise the
shared predicate through `require()`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
