lcx412 opened a new pull request, #29874:
URL: https://github.com/apache/flink/pull/29874
## What is the purpose of the change
Avoid a second security installation when application mode installs the
security context before fetching user artifacts and again in
`ClusterEntrypoint.startCluster()`. For Kerberos, the second installation
performs another login and can replace the process login UGI, leaving clients
created under the first UGI without refreshed delegation tokens.
## Brief change log
- Add value semantics to `SecurityConfiguration` for the options consumed by
the bundled security modules (`security.*`, `zookeeper.sasl.*`,
`flink.hadoop.*`, `fs.hdfs.*` and `io.tmp.dirs`) and the configured security
factories.
- Remember the last successfully installed `SecurityConfiguration` in
`SecurityUtils`.
- Make `SecurityUtils.install()` synchronized and skip re-installation when
the new configuration is equivalent.
- Clear the remembered configuration in `uninstall()`.
- Ignore unrelated runtime options such as `pipeline.jars`,
`pipeline.classpaths` and `execution.target` for installation idempotency.
## Verifying this change
This change added tests and can be verified as follows:
- `SecurityUtilsInstallTest`: equal configuration after adding pipeline
options does not reinstall; a different security-relevant configuration does
reinstall; install after uninstall installs again.
- `SecurityConfigurationTest`: security-relevant prefixes affect equality;
unrelated options do not.
- Existing `SecurityUtilsTest` continues to pass.
Validation performed on `master` (2.5-SNAPSHOT, Java 17, Hadoop 3.4.3):
`mvn -pl flink-runtime -am test
-Dtest='SecurityUtilsInstallTest,SecurityConfigurationTest,SecurityUtilsTest'
-Dsurefire.failIfNoSpecifiedTests=false -Dfast -Dspotless.check.skip
-Dcheckstyle.skip -Dmaven.javadoc.skip=true`
Result: `Tests run: 16, Failures: 0, Errors: 0`. `spotless:apply` and
`checkstyle:check` also pass.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changed class annotated with
`@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its
components), Checkpointing, Kubernetes/Yarn, ZooKeeper: yes, avoids a redundant
Kerberos login in application mode
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Codex CLI 0.167.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
