viirya commented on PR #58011: URL: https://github.com/apache/spark/pull/58011#issuecomment-5320693450
Good catch — you're right, the example was missing `;use_ssl=true`, so as written it would have built a plaintext channel. I've pushed a fix that adds it. On testing: I verified the examples against an open-source setup — an Apache Spark Connect server (`start-connect-server`) behind the open-source Spark Connect Gateway, fronted by ingress-nginx (v1.15.1) on a local kind cluster — not a Databricks server. The `default_authority` routing runs a real `spark.sql()` end-to-end through the ingress, over both plaintext and TLS. One caveat I added to the doc while confirming the TLS path: `DefaultChannelBuilder` with `use_ssl=true` verifies against the system trusted CA store, so for a self-signed/internal CA the client has to trust that CA out-of-band (e.g. `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH`) — in my test I trusted the test CA that way. I kept the proxy's own TLS configuration out of scope for this doc, since that's part of the ingress setup rather than the Spark client. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
