shrirangmhalgi opened a new pull request, #57262: URL: https://github.com/apache/spark/pull/57262
### What changes were proposed in this pull request? This PR adds `TokenIngestor` interface and `FileTokenIngestor` implementation for OIDC credential propagation framework (SPARK-57703). 1. `TokenIngestor`: Added `@DeveloperApi` interface containing single method `load()` that returns `Optional<UserContext>`, providing the abstraction for reading identity tokens. 2. `FileTokenIngestor`: `FileTokenIngestor` reads an OIDC JWT from a file path (e.g. Kubernetes projected service account token at `/var/run/secrets/tokens/spark-identity`), parses claims (sub, iss, iat, exp) into a `UserContext`, detects file rotation via `mtime` caching, and handles errors gracefully (missing file, empty content, malformed JWT all return Optional.empty() without throwing). ### Why are the changes needed? This is subtask 3 of the OIDC Credential Propagation SPIP (SPARK-57703). The `UserCredentialManager` (subtask 4) needs a way to obtain the current identity token from the local filesystem. On Kubernetes, identity tokens are delivered as projected volumes that are periodically rotated by kubelet. `FileTokenIngestor` will act as a bridge between these filesystem-delivered tokens and the credential propagation framework, supporting both workload-level service account tokens and per-user identity tokens. ### Does this PR introduce _any_ user-facing change? No. These are internal SPIs annotated @DeveloperApi that will be consumed by `UserCredentialManager` in a subsequent OIDC PRs. No configuration keys are activated and no existing behavior is changed. ### How was this patch tested? Added unit tests in `FileTokenIngestorSuite` covering: 1. Valid token parsing (claims extraction, UserContext construction) 2. File rotation detection (mtime-based re-parse) 3. Missing file handling 4. Empty file and whitespace-only file handling 5. Malformed JWT handling 6. Missing required claims (`sub`, `iss`) 7. Optional claims absent (iat, exp → null Instant) 8. Mtime caching (same file returns cached result) 9. Kubernetes projected SA token format 10. Per-user identity token format ### Was this patch authored or co-authored using generative AI tooling? No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
