sweb commented on code in PR #58010:
URL: https://github.com/apache/spark/pull/58010#discussion_r4211291860
##########
resource-managers/kubernetes/core/src/test/scala/org/apache/spark/deploy/k8s/features/BasicExecutorFeatureStepSuite.scala:
##########
@@ -421,6 +421,140 @@ class BasicExecutorFeatureStepSuite extends SparkFunSuite
with BeforeAndAfter {
checkEnv(executor, conf, Map(SecurityManager.ENV_AUTH_SECRET ->
"my-auth-secret"))
}
+ test("SSL RPC password propagation") {
+ val conf = baseConf.clone()
+ .set("spark.ssl.rpc.enabled", "true")
+ .set("spark.ssl.rpc.keyStorePassword", "keyStorePass")
+ .set("spark.ssl.rpc.keyPassword", "keyPass")
+ .set("spark.ssl.rpc.privateKeyPassword", "privateKeyPass")
+ .set("spark.ssl.rpc.trustStorePassword", "trustStorePass")
+
+ val secMgr = new SecurityManager(conf)
+ val step = new BasicExecutorFeatureStep(
+ KubernetesTestConf.createExecutorConf(
+ sparkConf = conf,
+ sslRpcPasswordEnvs = secMgr.getEnvironmentForSslRpcPasswords),
+ defaultProfile)
+
+ val executor = step.configurePod(SparkPod.initialPod())
+ checkEnv(executor, conf, Map(
+ SSLOptions.ENV_RPC_SSL_KEY_STORE_PASSWORD -> "keyStorePass",
+ SSLOptions.ENV_RPC_SSL_KEY_PASSWORD -> "keyPass",
+ SSLOptions.ENV_RPC_SSL_PRIVATE_KEY_PASSWORD -> "privateKeyPass",
+ SSLOptions.ENV_RPC_SSL_TRUST_STORE_PASSWORD -> "trustStorePass"))
+ }
+
+ test("SSL RPC passwords shouldn't propagate if RPC SSL is disabled") {
Review Comment:
my bad - thank you for noticing this. Addressed in
https://github.com/apache/spark/pull/58010/changes/02255a829394a1d11edd7116bf039c1e6445ba8c
##########
resource-managers/kubernetes/core/src/main/scala/org/apache/spark/deploy/k8s/features/BasicExecutorFeatureStep.scala:
##########
@@ -142,6 +142,21 @@ private[spark] class BasicExecutorFeatureStep(
case _ => Nil
}.getOrElse(Nil)
+ // SparkConf.isExecutorStartupConf withholds the spark.ssl.* passwords
from the
+ // executor conf. The pod allocator resolves them from the driver
SecurityManager
+ // and passes them in through the environment, as the standalone worker
does in
+ // CommandUtils. A name the user already binds, via
+ // spark.kubernetes.executor.secretKeyRef, spark.executorEnv or the pod
template,
+ // is skipped and the user's value wins: buildEnvVars does not
deduplicate and
+ // Kubernetes resolves a repeated name last-wins.
+ val userBoundEnvNames = kubernetesConf.secretEnvNamesToKeyRefs.keySet ++
Review Comment:
Reworded - addressed in
https://github.com/apache/spark/pull/58010/changes/59004616f6da7536a5b7ccf89e9726d5a6d8acd4
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
