HyukjinKwon commented on code in PR #59185:
URL: https://github.com/apache/spark/pull/59185#discussion_r4164939589
##########
core/src/main/scala/org/apache/spark/SecurityManager.scala:
##########
@@ -454,4 +459,45 @@ private[spark] object SecurityManager {
// key used to store the spark secret in the Hadoop UGI
val SECRET_LOOKUP_KEY = new Text("sparkCookie")
+
+ // `spark.ssl.rpc.enabled` has no Scala ConfigEntry (it is read directly in
TransportConf), so
+ // its key is defined here as a single source of truth for the code that
needs to read it.
+ private[spark] val SSL_RPC_ENABLED_CONF = "spark.ssl.rpc.enabled"
+
+ /**
+ * Returns true if Spark's RPC channel is encrypted by any supported
mechanism: SSL-based RPC
+ * encryption (`spark.ssl.rpc.enabled`), or authentication
(`spark.authenticate`) enabled
+ * together with either AES-based encryption
(`spark.network.crypto.enabled`) or the separate
+ * (deprecated) SASL-based encryption
(`spark.authenticate.enableSaslEncryption`).
+ *
+ * This is intentionally distinct from the instance method
+ * [[SecurityManager.isEncryptionEnabled]]:
+ * - `isEncryptionEnabled` reports whether AES/SASL *network* encryption is
in effect and
+ * treats SSL RPC as *disabling* it (returning false when
`spark.ssl.rpc.enabled` is set),
+ * because AES/SASL and SSL RPC are mutually exclusive transports. It
also does not require
+ * `spark.authenticate`, so it can return true for a configuration that
does not actually
+ * encrypt the channel.
+ * - This predicate instead answers "is the RPC channel encrypted at all?",
treating SSL RPC
+ * as encryption and requiring `spark.authenticate` for the AES/SASL
path. It must not be
+ * replaced by `isEncryptionEnabled`.
+ *
+ * It is shared by the two credential-propagation paths so they cannot drift
apart: the
+ * direct-credential-provider path in `HadoopDelegationTokenManager` fails
startup via
+ * `require()`, while OIDC credential propagation only warns.
Review Comment:
**Nit (P3):** Since `spark.security.oidc.requireRpcEncryption` was added,
this is no longer accurate: `UserCredentialManager.checkRpcEncryption` throws
`IllegalArgumentException` when that config is true and RPC encryption is not
configured. Something like "while OIDC credential propagation warns by default
and fails startup only when `spark.security.oidc.requireRpcEncryption` is true"
would match the code.
**Verification:**
- **Inspection:** The predicate's scaladoc description of the OIDC path
matches checkRpcEncryption's behavior: it warns when requireRpcEncryption is
false and throws when it is true.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
