{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/302","repository_url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/302/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/302/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/302/events","html_url":"https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/issues/302","id":365692464,"node_id":"MDU6SXNzdWUzNjU2OTI0NjQ=","number":302,"title":"Kerberos Support","user":{"login":"kalvinnchau","id":3486716,"node_id":"MDQ6VXNlcjM0ODY3MTY=","avatar_url":"https://avatars0.githubusercontent.com/u/3486716?v=4","gravatar_id":"","url":"https://api.github.com/users/kalvinnchau","html_url":"https://github.com/kalvinnchau","followers_url":"https://api.github.com/users/kalvinnchau/followers","following_url":"https://api.github.com/users/kalvinnchau/following{/other_user}","gists_url":"https://api.github.com/users/kalvinnchau/gists{/gist_id}","starred_url":"https://api.github.com/users/kalvinnchau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kalvinnchau/subscriptions","organizations_url":"https://api.github.com/users/kalvinnchau/orgs","repos_url":"https://api.github.com/users/kalvinnchau/repos","events_url":"https://api.github.com/users/kalvinnchau/events{/privacy}","received_events_url":"https://api.github.com/users/kalvinnchau/received_events","type":"User","site_admin":false},"labels":[{"id":794154609,"node_id":"MDU6TGFiZWw3OTQxNTQ2MDk=","url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-02T00:22:49Z","updated_at":"2018-10-02T04:41:28Z","closed_at":null,"author_association":"NONE","body":"Once https://github.com/apache/spark/pull/21669/files is pulled into the mainline spark, there will be kerberos support for HDFS clusters that use kerberos for authentication.\r\n\r\nI wasn't able to find anything about the approach for Kerberos with the spark-operator, so I'm hoping to get a discussion started and maybe take a stab at implementation :)\r\n\r\nI was thinking of using the approach where it would pass a local keytab/principal [Option 2](https://github.com/apache/spark/blob/5f52a1aa788fb13b7b2a841cfe04eb2309953cbd/docs/security.md#secure-interaction-with-kubernetes) to do the authentication. The operator could mount in the secret that contains the keytab and principal and pass them into the command line start-up command."},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/comments/426147114","html_url":"https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/issues/302#issuecomment-426147114","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/spark-on-k8s-operator/issues/302","id":426147114,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjE0NzExNA==","user":{"login":"liyinan926","id":3709137,"node_id":"MDQ6VXNlcjM3MDkxMzc=","avatar_url":"https://avatars2.githubusercontent.com/u/3709137?v=4","gravatar_id":"","url":"https://api.github.com/users/liyinan926","html_url":"https://github.com/liyinan926","followers_url":"https://api.github.com/users/liyinan926/followers","following_url":"https://api.github.com/users/liyinan926/following{/other_user}","gists_url":"https://api.github.com/users/liyinan926/gists{/gist_id}","starred_url":"https://api.github.com/users/liyinan926/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liyinan926/subscriptions","organizations_url":"https://api.github.com/users/liyinan926/orgs","repos_url":"https://api.github.com/users/liyinan926/repos","events_url":"https://api.github.com/users/liyinan926/events{/privacy}","received_events_url":"https://api.github.com/users/liyinan926/received_events","type":"User","site_admin":false},"created_at":"2018-10-02T04:41:28Z","updated_at":"2018-10-02T04:41:28Z","author_association":"MEMBER","body":"> 'm not sure if the spark.kubernetes.driver.secrets.[SecretName] are mounted before start-up we could potentially use those and check in the operator if one named keytab exist or some special keyword. Seems like it might be better to have a new specific configuration option for the spark-operator that we look for and mount them in that way.\r\n\r\nI think it's better to be explicit on this and not rely on certain naming scheme, which is hard to validate.   "}}
{"actor":{"display_login":"liyinan926"}}