uros-b commented on code in PR #58010:
URL: https://github.com/apache/spark/pull/58010#discussion_r3935369659
##########
resource-managers/kubernetes/core/src/main/scala/org/apache/spark/deploy/k8s/features/BasicExecutorFeatureStep.scala:
##########
@@ -143,6 +143,15 @@ private[spark] class BasicExecutorFeatureStep(
case _ => Nil
}.getOrElse(Nil)
+ // SparkConf.isExecutorStartupConf withholds the spark.ssl.* passwords
from the
+ // executor conf. Pass them through the environment, as the standalone
worker
+ // does in CommandUtils. Names the user already supplies via
+ // spark.kubernetes.executor.secretKeyRef are skipped, so that an
explicit
+ // secret reference is not shadowed by a literal password in the pod
spec.
+ val sslRpcPasswords = secMgr.getEnvironmentForSslRpcPasswords.filterNot {
+ case (name, _) => kubernetesConf.secretEnvNamesToKeyRefs.contains(name)
+ }.toSeq
+
Review Comment:
docs/security.md already says that on Kubernetes the auth secret is injected
as an env var, so anyone who can list pods can read it. This PR puts keystore /
truststore / key passwords on that same channel. That’s the intended standalone
design, but it is a user-facing security change on K8s and should be called out
next to the existing auth-secret paragraph. Users who don’t want literals can
keep using spark.kubernetes.executor.secretKeyRef._SPARK_SSL_RPC_*.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
