Github user tgravescs commented on the issue:
https://github.com/apache/spark/pull/22852
we can add stronger wording for standalone if you want, I know the text
was recently updated (I believe by you) to have the below:
> For other resource managers, spark.authenticate.secret must be configured
on each of the nodes. This secret will be shared by all the daemons and
applications, so this deployment configuration is not as secure as the above,
especially when considering multi-tenant clusters. In this configuration, a
user with the secret can effectively impersonate any other user.
Do you have specific suggestion on where you want to put that? The reason
I didn't put stronger was because if you are running it in isolated one client
environment then the authentication part via secret doesn't matter that much.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
