{"action":"created","comment":{"url":"https://api.github.com/repos/apache/spark/pulls/comments/238211153","pull_request_review_id":180694630,"id":238211153,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzODIxMTE1Mw==","diff_hunk":"@@ -624,3 +624,57 @@ For experimenting on `spark-shell`, you can also use `--packages` to add `spark-\n \n See [Application Submission Guide](submitting-applications.html) for more details about submitting\n applications with external dependencies.\n+\n+## Security\n+\n+Kafka 0.9.0.0 introduced several features that increases security in a cluster. For detailed\n+description about these possibilities, see [Kafka security docs](http://kafka.apache.org/documentation.html#security).\n+\n+It's worth noting that security is optional and turned off by default.\n+\n+Spark supports the following ways to authenticate against Kafka cluster:\n+- **Delegation token (introduced in Kafka broker 1.1.0)**: This way the application can be configured\n+  via Spark parameters and may not need JAAS login configuration (Spark can use Kafka's dynamic JAAS\n+  configuration feature). For further information about delegation tokens, see\n+  [Kafka delegation token docs](http://kafka.apache.org/documentation/#security_delegation_token).\n+\n+  The process is initiated by Spark's Kafka delegation token provider. This is enabled by default\n+  but can be turned off with `spark.security.credentials.kafka.enabled`. When\n+  `spark.kafka.bootstrap.servers` set Spark looks for authentication information in the following\n+  order and choose the first available to log in:\n+  - **JAAS login configuration**\n+  - **Keytab file**, such as,\n+\n+        ./bin/spark-submit \\\n+            --keytab <KEYTAB_FILE> \\\n+            --principal <PRINCIPAL> \\\n+            --conf spark.kafka.bootstrap.servers=<KAFKA_SERVERS> \\\n+            ...\n+\n+  - **Kerberos credential cache**, such as,\n+\n+        ./bin/spark-submit \\\n+            --conf spark.kafka.bootstrap.servers=<KAFKA_SERVERS> \\\n+            ...\n+\n+  Spark supports the following authentication protocols to obtain token:\n+  - **SASL SSL (default)**: With `GSSAPI` mechanism Kerberos used for authentication and SSL for encryption.\n+  - **SSL**: It's leveraging a capability from SSL called 2-way authentication. The server authenticate\n+    clients through certificates. Please note 2-way authentication must be enabled on Kafka brokers.\n+  - **SASL PLAINTEXT (for testing)**: With `GSSAPI` mechanism Kerberos used for authentication but\n+    because there is no encryption it's only for testing purposes.\n+\n+  After delegation token successfully obtained Spark spreads it across nodes and renews it accordingly.","path":"docs/structured-streaming-kafka-integration.md","position":44,"original_position":44,"commit_id":"e53631b8f313a2b34ec38393ea14527c3f7d8458","original_commit_id":"e53631b8f313a2b34ec38393ea14527c3f7d8458","user":{"login":"gaborgsomogyi","id":18561820,"node_id":"MDQ6VXNlcjE4NTYxODIw","avatar_url":"https://avatars2.githubusercontent.com/u/18561820?v=4","gravatar_id":"","url":"https://api.github.com/users/gaborgsomogyi","html_url":"https://github.com/gaborgsomogyi","followers_url":"https://api.github.com/users/gaborgsomogyi/followers","following_url":"https://api.github.com/users/gaborgsomogyi/following{/other_user}","gists_url":"https://api.github.com/users/gaborgsomogyi/gists{/gist_id}","starred_url":"https://api.github.com/users/gaborgsomogyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaborgsomogyi/subscriptions","organizations_url":"https://api.github.com/users/gaborgsomogyi/orgs","repos_url":"https://api.github.com/users/gaborgsomogyi/repos","events_url":"https://api.github.com/users/gaborgsomogyi/events{/privacy}","received_events_url":"https://api.github.com/users/gaborgsomogyi/received_events","type":"User","site_admin":false},"body":"Yeah, it's better that way and and changed.","created_at":"2018-12-03T10:21:16Z","updated_at":"2018-12-03T10:21:16Z","html_url":"https://github.com/apache/spark/pull/23195#discussion_r238211153","pull_request_url":"https://api.github.com/repos/apache/spark/pulls/23195","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/apache/spark/pulls/comments/238211153"},"html":{"href":"https://github.com/apache/spark/pull/23195#discussion_r238211153"},"pull_request":{"href":"https://api.github.com/repos/apache/spark/pulls/23195"}},"in_reply_to_id":238090666},"pull_request":{"url":"https://api.github.com/repos/apache/spark/pulls/23195","id":235192105,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM1MTkyMTA1","html_url":"https://github.com/apache/spark/pull/23195","diff_url":"https://github.com/apache/spark/pull/23195.diff","patch_url":"https://github.com/apache/spark/pull/23195.patch","issue_url":"https://api.github.com/repos/apache/spark/issues/23195","number":23195,"state":"open","locked":false,"title":"[SPARK-26236][SS] Add kafka delegation token support documentation.","user":{"login":"gaborgsomogyi","id":18561820,"node_id":"MDQ6VXNlcjE4NTYxODIw","avatar_url":"https://avatars2.githubusercontent.com/u/18561820?v=4","gravatar_id":"","url":"https://api.github.com/users/gaborgsomogyi","html_url":"https://github.com/gaborgsomogyi","followers_url":"https://api.github.com/users/gaborgsomogyi/followers","following_url":"https://api.github.com/users/gaborgsomogyi/following{/other_user}","gists_url":"https://api.github.com/users/gaborgsomogyi/gists{/gist_id}","starred_url":"https://api.github.com/users/gaborgsomogyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaborgsomogyi/subscriptions","organizations_url":"https://api.github.com/users/gaborgsomogyi/orgs","repos_url":"https://api.github.com/users/gaborgsomogyi/repos","events_url":"https://api.github.com/users/gaborgsomogyi/events{/privacy}","received_events_url":"https://api.github.com/users/gaborgsomogyi/received_events","type":"User","site_admin":false},"body":"## What changes were proposed in this pull request?\r\n\r\nKafka delegation token support implemented in [PR#22598](https://github.com/apache/spark/pull/22598) but that didn't contain documentation because of rapid changes. Because it has been merged in this PR I've documented it.\r\n\r\n## How was this patch tested?\r\njekyll build + manual html check\r\n","created_at":"2018-12-01T13:01:23Z","updated_at":"2018-12-03T10:21:16Z","closed_at":null,"merged_at":null,"merge_commit_sha":"55b9026b317d4ad0b15d35cfb332c564bed577ee","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/apache/spark/pulls/23195/commits","review_comments_url":"https://api.github.com/repos/apache/spark/pulls/23195/comments","review_comment_url":"https://api.github.com/repos/apache/spark/pulls/comments{/number}","comments_url":"https://api.github.com/repos/apache/spark/issues/23195/comments","statuses_url":"https://api.github.com/repos/apache/spark/statuses/e53631b8f313a2b34ec38393ea14527c3f7d8458","head":{"label":"gaborgsomogyi:SPARK-26236","ref":"SPARK-26236","sha":"e53631b8f313a2b34ec38393ea14527c3f7d8458","user":{"login":"gaborgsomogyi","id":18561820,"node_id":"MDQ6VXNlcjE4NTYxODIw","avatar_url":"https://avatars2.githubusercontent.com/u/18561820?v=4","gravatar_id":"","url":"https://api.github.com/users/gaborgsomogyi","html_url":"https://github.com/gaborgsomogyi","followers_url":"https://api.github.com/users/gaborgsomogyi/followers","following_url":"https://api.github.com/users/gaborgsomogyi/following{/other_user}","gists_url":"https://api.github.com/users/gaborgsomogyi/gists{/gist_id}","starred_url":"https://api.github.com/users/gaborgsomogyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaborgsomogyi/subscriptions","organizations_url":"https://api.github.com/users/gaborgsomogyi/orgs","repos_url":"https://api.github.com/users/gaborgsomogyi/repos","events_url":"https://api.github.com/users/gaborgsomogyi/events{/privacy}","received_events_url":"https://api.github.com/users/gaborgsomogyi/received_events","type":"User","site_admin":false},"repo":{"id":111547097,"node_id":"MDEwOlJlcG9zaXRvcnkxMTE1NDcwOTc=","name":"spark","full_name":"gaborgsomogyi/spark","private":false,"owner":{"login":"gaborgsomogyi","id":18561820,"node_id":"MDQ6VXNlcjE4NTYxODIw","avatar_url":"https://avatars2.githubusercontent.com/u/18561820?v=4","gravatar_id":"","url":"https://api.github.com/users/gaborgsomogyi","html_url":"https://github.com/gaborgsomogyi","followers_url":"https://api.github.com/users/gaborgsomogyi/followers","following_url":"https://api.github.com/users/gaborgsomogyi/following{/other_user}","gists_url":"https://api.github.com/users/gaborgsomogyi/gists{/gist_id}","starred_url":"https://api.github.com/users/gaborgsomogyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaborgsomogyi/subscriptions","organizations_url":"https://api.github.com/users/gaborgsomogyi/orgs","repos_url":"https://api.github.com/users/gaborgsomogyi/repos","events_url":"https://api.github.com/users/gaborgsomogyi/events{/privacy}","received_events_url":"https://api.github.com/users/gaborgsomogyi/received_events","type":"User","site_admin":false},"html_url":"https://github.com/gaborgsomogyi/spark","description":"Mirror of Apache Spark","fork":true,"url":"https://api.github.com/repos/gaborgsomogyi/spark","forks_url":"https://api.github.com/repos/gaborgsomogyi/spark/forks","keys_url":"https://api.github.com/repos/gaborgsomogyi/spark/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gaborgsomogyi/spark/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gaborgsomogyi/spark/teams","hooks_url":"https://api.github.com/repos/gaborgsomogyi/spark/hooks","issue_events_url":"https://api.github.com/repos/gaborgsomogyi/spark/issues/events{/number}","events_url":"https://api.github.com/repos/gaborgsomogyi/spark/events","assignees_url":"https://api.github.com/repos/gaborgsomogyi/spark/assignees{/user}","branches_url":"https://api.github.com/repos/gaborgsomogyi/spark/branches{/branch}","tags_url":"https://api.github.com/repos/gaborgsomogyi/spark/tags","blobs_url":"https://api.github.com/repos/gaborgsomogyi/spark/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gaborgsomogyi/spark/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gaborgsomogyi/spark/git/refs{/sha}","trees_url":"https://api.github.com/repos/gaborgsomogyi/spark/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gaborgsomogyi/spark/statuses/{sha}","languages_url":"https://api.github.com/repos/gaborgsomogyi/spark/languages","stargazers_url":"https://api.github.com/repos/gaborgsomogyi/spark/stargazers","contributors_url":"https://api.github.com/repos/gaborgsomogyi/spark/contributors","subscribers_url":"https://api.github.com/repos/gaborgsomogyi/spark/subscribers","subscription_url":"https://api.github.com/repos/gaborgsomogyi/spark/subscription","commits_url":"https://api.github.com/repos/gaborgsomogyi/spark/commits{/sha}","git_commits_url":"https://api.github.com/repos/gaborgsomogyi/spark/git/commits{/sha}","comments_url":"https://api.github.com/repos/gaborgsomogyi/spark/comments{/number}","issue_comment_url":"https://api.github.com/repos/gaborgsomogyi/spark/issues/comments{/number}","contents_url":"https://api.github.com/repos/gaborgsomogyi/spark/contents/{+path}","compare_url":"https://api.github.com/repos/gaborgsomogyi/spark/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gaborgsomogyi/spark/merges","archive_url":"https://api.github.com/repos/gaborgsomogyi/spark/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gaborgsomogyi/spark/downloads","issues_url":"https://api.github.com/repos/gaborgsomogyi/spark/issues{/number}","pulls_url":"https://api.github.com/repos/gaborgsomogyi/spark/pulls{/number}","milestones_url":"https://api.github.com/repos/gaborgsomogyi/spark/milestones{/number}","notifications_url":"https://api.github.com/repos/gaborgsomogyi/spark/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gaborgsomogyi/spark/labels{/name}","releases_url":"https://api.github.com/repos/gaborgsomogyi/spark/releases{/id}","deployments_url":"https://api.github.com/repos/gaborgsomogyi/spark/deployments","created_at":"2017-11-21T12:38:03Z","updated_at":"2018-11-30T10:42:41Z","pushed_at":"2018-12-01T12:56:32Z","git_url":"git://github.com/gaborgsomogyi/spark.git","ssh_url":"git@github.com:gaborgsomogyi/spark.git","clone_url":"https://github.com/gaborgsomogyi/spark.git","svn_url":"https://github.com/gaborgsomogyi/spark","homepage":null,"size":284255,"stargazers_count":0,"watchers_count":0,"language":"Scala","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"apache:master","ref":"master","sha":"327ac83f5cf33c84775a95442862bea56d8a0005","user":{"login":"apache","id":47359,"node_id":"MDEyOk9yZ2FuaXphdGlvbjQ3MzU5","avatar_url":"https://avatars0.githubusercontent.com/u/47359?v=4","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"repo":{"id":17165658,"node_id":"MDEwOlJlcG9zaXRvcnkxNzE2NTY1OA==","name":"spark","full_name":"apache/spark","private":false,"owner":{"login":"apache","id":47359,"node_id":"MDEyOk9yZ2FuaXphdGlvbjQ3MzU5","avatar_url":"https://avatars0.githubusercontent.com/u/47359?v=4","gravatar_id":"","url":"https://api.github.com/users/apache","html_url":"https://github.com/apache","followers_url":"https://api.github.com/users/apache/followers","following_url":"https://api.github.com/users/apache/following{/other_user}","gists_url":"https://api.github.com/users/apache/gists{/gist_id}","starred_url":"https://api.github.com/users/apache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apache/subscriptions","organizations_url":"https://api.github.com/users/apache/orgs","repos_url":"https://api.github.com/users/apache/repos","events_url":"https://api.github.com/users/apache/events{/privacy}","received_events_url":"https://api.github.com/users/apache/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/apache/spark","description":"Mirror of Apache Spark","fork":false,"url":"https://api.github.com/repos/apache/spark","forks_url":"https://api.github.com/repos/apache/spark/forks","keys_url":"https://api.github.com/repos/apache/spark/keys{/key_id}","collaborators_url":"https://api.github.com/repos/apache/spark/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/apache/spark/teams","hooks_url":"https://api.github.com/repos/apache/spark/hooks","issue_events_url":"https://api.github.com/repos/apache/spark/issues/events{/number}","events_url":"https://api.github.com/repos/apache/spark/events","assignees_url":"https://api.github.com/repos/apache/spark/assignees{/user}","branches_url":"https://api.github.com/repos/apache/spark/branches{/branch}","tags_url":"https://api.github.com/repos/apache/spark/tags","blobs_url":"https://api.github.com/repos/apache/spark/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/apache/spark/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/apache/spark/git/refs{/sha}","trees_url":"https://api.github.com/repos/apache/spark/git/trees{/sha}","statuses_url":"https://api.github.com/repos/apache/spark/statuses/{sha}","languages_url":"https://api.github.com/repos/apache/spark/languages","stargazers_url":"https://api.github.com/repos/apache/spark/stargazers","contributors_url":"https://api.github.com/repos/apache/spark/contributors","subscribers_url":"https://api.github.com/repos/apache/spark/subscribers","subscription_url":"https://api.github.com/repos/apache/spark/subscription","commits_url":"https://api.github.com/repos/apache/spark/commits{/sha}","git_commits_url":"https://api.github.com/repos/apache/spark/git/commits{/sha}","comments_url":"https://api.github.com/repos/apache/spark/comments{/number}","issue_comment_url":"https://api.github.com/repos/apache/spark/issues/comments{/number}","contents_url":"https://api.github.com/repos/apache/spark/contents/{+path}","compare_url":"https://api.github.com/repos/apache/spark/compare/{base}...{head}","merges_url":"https://api.github.com/repos/apache/spark/merges","archive_url":"https://api.github.com/repos/apache/spark/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/apache/spark/downloads","issues_url":"https://api.github.com/repos/apache/spark/issues{/number}","pulls_url":"https://api.github.com/repos/apache/spark/pulls{/number}","milestones_url":"https://api.github.com/repos/apache/spark/milestones{/number}","notifications_url":"https://api.github.com/repos/apache/spark/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/apache/spark/labels{/name}","releases_url":"https://api.github.com/repos/apache/spark/releases{/id}","deployments_url":"https://api.github.com/repos/apache/spark/deployments","created_at":"2014-02-25T08:00:08Z","updated_at":"2018-12-03T09:02:19Z","pushed_at":"2018-12-03T10:16:34Z","git_url":"git://github.com/apache/spark.git","ssh_url":"git@github.com:apache/spark.git","clone_url":"https://github.com/apache/spark.git","svn_url":"https://github.com/apache/spark","homepage":null,"size":288354,"stargazers_count":19726,"watchers_count":19726,"language":"Scala","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":17591,"mirror_url":null,"archived":false,"open_issues_count":499,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":17591,"open_issues":499,"watchers":19726,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/apache/spark/pulls/23195"},"html":{"href":"https://github.com/apache/spark/pull/23195"},"issue":{"href":"https://api.github.com/repos/apache/spark/issues/23195"},"comments":{"href":"https://api.github.com/repos/apache/spark/issues/23195/comments"},"review_comments":{"href":"https://api.github.com/repos/apache/spark/pulls/23195/comments"},"review_comment":{"href":"https://api.github.com/repos/apache/spark/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/apache/spark/pulls/23195/commits"},"statuses":{"href":"https://api.github.com/repos/apache/spark/statuses/e53631b8f313a2b34ec38393ea14527c3f7d8458"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"gaborgsomogyi"}}