{"action":"created","issue":{"url":"https://api.github.com/repos/apache/spark/issues/22911","repository_url":"https://api.github.com/repos/apache/spark","labels_url":"https://api.github.com/repos/apache/spark/issues/22911/labels{/name}","comments_url":"https://api.github.com/repos/apache/spark/issues/22911/comments","events_url":"https://api.github.com/repos/apache/spark/issues/22911/events","html_url":"https://github.com/apache/spark/pull/22911","id":376112508,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI3NDA0NDMx","number":22911,"title":"[SPARK-25815][k8s] Support kerberos in client mode, keytab-based token renewal.","user":{"login":"vanzin","id":1694083,"node_id":"MDQ6VXNlcjE2OTQwODM=","avatar_url":"https://avatars0.githubusercontent.com/u/1694083?v=4","gravatar_id":"","url":"https://api.github.com/users/vanzin","html_url":"https://github.com/vanzin","followers_url":"https://api.github.com/users/vanzin/followers","following_url":"https://api.github.com/users/vanzin/following{/other_user}","gists_url":"https://api.github.com/users/vanzin/gists{/gist_id}","starred_url":"https://api.github.com/users/vanzin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vanzin/subscriptions","organizations_url":"https://api.github.com/users/vanzin/orgs","repos_url":"https://api.github.com/users/vanzin/repos","events_url":"https://api.github.com/users/vanzin/events{/privacy}","received_events_url":"https://api.github.com/users/vanzin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":26,"created_at":"2018-10-31T18:53:27Z","updated_at":"2018-11-29T01:13:34Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/apache/spark/pulls/22911","html_url":"https://github.com/apache/spark/pull/22911","diff_url":"https://github.com/apache/spark/pull/22911.diff","patch_url":"https://github.com/apache/spark/pull/22911.patch"},"body":"This change hooks up the k8s backed to the updated HadoopDelegationTokenManager,\r\nso that delegation tokens are also available in client mode, and keytab-based token\r\nrenewal is enabled.\r\n\r\nThe change re-works the k8s feature steps related to kerberos so\r\nthat the driver does all the credential management and provides all\r\nthe needed information to executors - so nothing needs to be added\r\nto executor pods. This also makes cluster mode behave a lot more\r\nsimilarly to client mode, since no driver-related config steps are run\r\nin the latter case.\r\n\r\nThe main two things that don't need to happen in executors anymore are:\r\n\r\n- adding the Hadoop config to the executor pods: this is not needed\r\n  since the Spark driver will serialize the Hadoop config and send\r\n  it to executors when running tasks.\r\n\r\n- mounting the kerberos config file in the executor pods: this is\r\n  not needed once you remove the above. The Hadoop conf sent by\r\n  the driver with the tasks is already resolved (i.e. has all the\r\n  kerberos names properly defined), so executors do not need access\r\n  to the kerberos realm information anymore.\r\n\r\nThe change also avoids creating delegation tokens unnecessarily.\r\nThis means that they'll only be created if a secret with tokens\r\nwas not provided, and if a keytab is not provided. In either of\r\nthose cases, the driver code will handle delegation tokens: in\r\ncluster mode by creating a secret and stashing them, in client\r\nmode by using existing mechanisms to send DTs to executors.\r\n\r\nOne last feature: the change also allows defining a keytab with\r\na \"local:\" URI. This is supported in client mode (although that's\r\nthe same as not saying \"local:\"), and in k8s cluster mode. This\r\nallows the keytab to be mounted onto the image from a pre-existing\r\nsecret, for example.\r\n\r\nFinally, the new code always sets SPARK_USER in the driver and\r\nexecutor pods. This is in line with how other resource managers\r\nbehave: the submitting user reflects which user will access\r\nHadoop services in the app. (With kerberos, that's overridden\r\nby the logged in user.) That user is unrelated to the OS user\r\nthe app is running as inside the containers.\r\n\r\nTested:\r\n- client and cluster mode with kinit\r\n- cluster mode with keytab\r\n- cluster mode with local: keytab\r\n- YARN cluster with keytab (to make sure it isn't broken)"},"comment":{"url":"https://api.github.com/repos/apache/spark/issues/comments/442667801","html_url":"https://github.com/apache/spark/pull/22911#issuecomment-442667801","issue_url":"https://api.github.com/repos/apache/spark/issues/22911","id":442667801,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjY2NzgwMQ==","user":{"login":"AmplabJenkins","id":4031291,"node_id":"MDQ6VXNlcjQwMzEyOTE=","avatar_url":"https://avatars3.githubusercontent.com/u/4031291?v=4","gravatar_id":"","url":"https://api.github.com/users/AmplabJenkins","html_url":"https://github.com/AmplabJenkins","followers_url":"https://api.github.com/users/AmplabJenkins/followers","following_url":"https://api.github.com/users/AmplabJenkins/following{/other_user}","gists_url":"https://api.github.com/users/AmplabJenkins/gists{/gist_id}","starred_url":"https://api.github.com/users/AmplabJenkins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AmplabJenkins/subscriptions","organizations_url":"https://api.github.com/users/AmplabJenkins/orgs","repos_url":"https://api.github.com/users/AmplabJenkins/repos","events_url":"https://api.github.com/users/AmplabJenkins/events{/privacy}","received_events_url":"https://api.github.com/users/AmplabJenkins/received_events","type":"User","site_admin":false},"created_at":"2018-11-29T01:13:34Z","updated_at":"2018-11-29T01:13:34Z","author_association":"NONE","body":"Test FAILed.\nRefer to this link for build results (access rights to CI server needed): \nhttps://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/99404/\nTest FAILed."}}
{"actor":{"display_login":"AmplabJenkins"}}