sweb commented on code in PR #58010:
URL: https://github.com/apache/spark/pull/58010#discussion_r4211289736
##########
resource-managers/kubernetes/core/src/main/scala/org/apache/spark/deploy/k8s/KubernetesConf.scala:
##########
@@ -356,9 +357,11 @@ private[spark] object KubernetesConf {
appId: String,
driverPod: Option[Pod],
resourceProfileId: Int = DEFAULT_RESOURCE_PROFILE_ID,
- authSecret: Option[String] = None): KubernetesExecutorConf = {
+ authSecret: Option[String] = None,
+ sslRpcPasswordEnvs: Map[String, String] = Map.empty):
KubernetesExecutorConf = {
Review Comment:
Removed the default (as well for authSecret and set values explicitly in the
tests) - addressed in
https://github.com/apache/spark/pull/58010/changes/118c151904cf9278b69cc8b7e4c037ea1cf6ba4d
##########
docs/security.md:
##########
@@ -183,6 +183,14 @@ Unlike the other SSL settings for the UI, the RPC SSL is
*not* automatically ena
`spark.ssl.enabled` is set. It must be explicitly enabled, to ensure a safe
migration path for users
upgrading Spark versions.
+On Kubernetes, the passwords used by RPC SSL are propagated to executor pods
using environment
+variables, the same way as the authentication mechanics described under
[Kubernetes](#kubernetes)
+above. As with the authentication secret, any user who can list pods in the
namespace can read
+them, so access control rules should be properly set up or alternatively these
passwords should
+be supplied using `spark.kubernetes.executor.secretKeyRef`, for example
+`spark.kubernetes.executor.secretKeyRef._SPARK_SSL_RPC_KEY_STORE_PASSWORD=<secret-name>:<key>`.
Review Comment:
Addressed in
https://github.com/apache/spark/pull/58010/changes/59004616f6da7536a5b7ccf89e9726d5a6d8acd4
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
