{"action":"created","issue":{"url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/633","repository_url":"https://api.github.com/repos/apache-spark-on-k8s/spark","labels_url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/633/labels{/name}","comments_url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/633/comments","events_url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/633/events","html_url":"https://github.com/apache-spark-on-k8s/spark/issues/633","id":358308355,"node_id":"MDU6SXNzdWUzNTgzMDgzNTU=","number":633,"title":"spark-submit ignoring : spark.kubernetes.authenticate.driver.serviceAccountName","user":{"login":"purpletech77","id":23348140,"node_id":"MDQ6VXNlcjIzMzQ4MTQw","avatar_url":"https://avatars2.githubusercontent.com/u/23348140?v=4","gravatar_id":"","url":"https://api.github.com/users/purpletech77","html_url":"https://github.com/purpletech77","followers_url":"https://api.github.com/users/purpletech77/followers","following_url":"https://api.github.com/users/purpletech77/following{/other_user}","gists_url":"https://api.github.com/users/purpletech77/gists{/gist_id}","starred_url":"https://api.github.com/users/purpletech77/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/purpletech77/subscriptions","organizations_url":"https://api.github.com/users/purpletech77/orgs","repos_url":"https://api.github.com/users/purpletech77/repos","events_url":"https://api.github.com/users/purpletech77/events{/privacy}","received_events_url":"https://api.github.com/users/purpletech77/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-08T16:15:27Z","updated_at":"2018-09-10T09:14:13Z","closed_at":null,"author_association":"NONE","body":"```\r\n~/spark-2.3.0-bin-hadoop2.7 # bin/spark-submit \\\r\n>     --master k8s://kubecluster:443 \\\r\n>     --deploy-mode cluster \\\r\n>     --name spark-pi \\\r\n>     --conf spark.kubernetes.test.serviceAccountName=default:spark \\\r\n>     --class org.apache.spark.examples.SparkPi \\\r\n>     --conf spark.executor.instances=5 \\\r\n>     --conf spark.kubernetes.driver.container.image=registry/spark-driver:latest \\\r\n>     --conf spark.kubernetes.executor.container.image=registry/spark-executor:latest \\\r\n>     local:///home/user/spark-2.2.0-k8s-0.5.0-bin-2.7.3/examples/jars/spark-examples_2.11-2.2.0-k8s-0.5.0.jar\r\n\r\n```\r\n```\r\n2018-09-08 09:09:06 WARN  WatchConnectionManager:185 - Exec Failure: HTTP 403, Status: 403 - pods \"spark-pi-c75ce20fff8539b3969926697eb6a78c-driver\" is forbidden: User \"system:anonymous\" cannot watch pods in the namespace \"default\"\r\njava.net.ProtocolException: Expected HTTP 101 response but was '403 Forbidden'\r\n\tat okhttp3.internal.ws.RealWebSocket.checkResponse(RealWebSocket.java:216)\r\n\tat okhttp3.internal.ws.RealWebSocket$2.onResponse(RealWebSocket.java:183)\r\n\tat okhttp3.RealCall$AsyncCall.execute(RealCall.java:141)\r\n\tat okhttp3.internal.NamedRunnable.run(NamedRunnable.java:32)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n\tat java.lang.Thread.run(Thread.java:748)\r\nException in thread \"main\" io.fabric8.kubernetes.client.KubernetesClientException: pods \"spark-pi-c75ce20fff8539b3969926697eb6a78c-driver\" is forbidden: User \"system:anonymous\" cannot watch pods in the namespace \"default\"\r\n\tat io.fabric8.kubernetes.client.dsl.internal.WatchConnectionManager$2.onFailure(WatchConnectionManager.java:188)\r\n\tat okhttp3.internal.ws.RealWebSocket.failWebSocket(RealWebSocket.java:543)\r\n\tat okhttp3.internal.ws.RealWebSocket$2.onResponse(RealWebSocket.java:185)\r\n\tat okhttp3.RealCall$AsyncCall.execute(RealCall.java:141)\r\n\tat okhttp3.internal.NamedRunnable.run(NamedRunnable.java:32)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n\tat java.lang.Thread.run(Thread.java:748)\r\n2018-09-08 09:09:06 INFO  ShutdownHookManager:54 - Shutdown hook called\r\n2018-09-08 09:09:06 INFO  ShutdownHookManager:54 - Deleting directory /tmp/spark-fa5576a8-d883-4371-98de-69c2640991e5\r\n```"},"comment":{"url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/comments/419844466","html_url":"https://github.com/apache-spark-on-k8s/spark/issues/633#issuecomment-419844466","issue_url":"https://api.github.com/repos/apache-spark-on-k8s/spark/issues/633","id":419844466,"node_id":"MDEyOklzc3VlQ29tbWVudDQxOTg0NDQ2Ng==","user":{"login":"rvesse","id":2104864,"node_id":"MDQ6VXNlcjIxMDQ4NjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/2104864?v=4","gravatar_id":"","url":"https://api.github.com/users/rvesse","html_url":"https://github.com/rvesse","followers_url":"https://api.github.com/users/rvesse/followers","following_url":"https://api.github.com/users/rvesse/following{/other_user}","gists_url":"https://api.github.com/users/rvesse/gists{/gist_id}","starred_url":"https://api.github.com/users/rvesse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvesse/subscriptions","organizations_url":"https://api.github.com/users/rvesse/orgs","repos_url":"https://api.github.com/users/rvesse/repos","events_url":"https://api.github.com/users/rvesse/events{/privacy}","received_events_url":"https://api.github.com/users/rvesse/received_events","type":"User","site_admin":false},"created_at":"2018-09-10T09:14:13Z","updated_at":"2018-09-10T09:14:13Z","author_association":"NONE","body":"FYI - Spark on K8S has been merged upstream and is now being maintained as part of Apache Spark so issues should be reported on https://issues.apache.org/jira/\r\n\r\n---\r\n\r\nThis is expected behaviour though I don't believe well documented.\r\n\r\nThe service account is only used for the driver and executor pods.  However the submission client i.e. the local code running where you run `spark-submit` uses your own K8S config to monitor the ongoing progress of the driver and therefore needs to have sufficient permissions to do this."}}
{"actor":{"display_login":"rvesse"}}