[
https://issues.apache.org/jira/browse/SPARK-57893?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated SPARK-57893:
-----------------------------------
Labels: pull-request-available (was: )
> Implement UserCredentialManager
> -------------------------------
>
> Key: SPARK-57893
> URL: https://issues.apache.org/jira/browse/SPARK-57893
> Project: Spark
> Issue Type: Sub-task
> Components: Spark Core
> Affects Versions: 4.3.0
> Reporter: Kousuke Saruta
> Priority: Major
> Labels: pull-request-available
>
> This sub-task is part of the umbrella
> [SPARK-57703|https://issues.apache.org/jira/browse/SPARK-57703] (OIDC
> Credential Propagation).
> h2. Problem
> There is no component to orchestrate credential acquisition, renewal
> scheduling, and propagation triggering on the driver.
> h2. Goal
> Introduce {{UserCredentialManager}} that coordinates {{TokenIngestor}} and
> {{CredentialProvider}} to maintain fresh credentials and notify the backend
> when credentials are updated.
> h2. Scope
> * Lives in {{org.apache.spark.deploy.security}}, as a sibling of
> {{HadoopDelegationTokenManager}}
> * Started from {{CoarseGrainedSchedulerBackend.start()}} when
> {{spark.security.credentials.enabled=true}}
> * Responsibilities:
> *# Pull current {{UserContext}} via {{TokenIngestor.load()}}
> *# Call {{CredentialProvider.resolve()}} for each configured scheme
> *# Schedule next renewal based on {{min(identity token expiry, service
> credential expiry) - safetyMargin}}
> *# Retry with exponential backoff on failure
> *# Invoke callback to propagate updated credentials
> * Configuration: {{spark.security.credentials.renewal.safetyMargin}},
> {{spark.security.credentials.renewal.minInterval}}
> h2. Acceptance criteria
> * Manager starts, acquires initial credentials, and invokes the propagation
> callback.
> * Renewal is scheduled at the correct time (before expiry minus safety
> margin).
> * On {{TokenIngestor}} rotation, new credentials are acquired and propagated.
> * On failure, exponential backoff is applied.
> * {{HadoopDelegationTokenManager}} is unaffected (no code changes, coexists
> independently).
> * Unit tests with mocked TokenIngestor and FakeCredentialProvider.
> Reference: [SPIP design document Appendix
> B|https://docs.google.com/document/d/1usJKncCPMiyFUg7aIdpZ0HQsklXIHow_sU_6dfFMjN0/edit].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
