HyukjinKwon opened a new pull request, #58599: URL: https://github.com/apache/spark/pull/58599
### What changes were proposed in this pull request? Add `spark.yarn.am.trustProxyUserCookie` (default `true`, no behavior change). When set to `false`, `AmIpFilter` ignores the `proxy-user` cookie and proxy requests are treated as having no user. It is plumbed as a `TRUST_PROXY_USER` filter init parameter from `ApplicationMaster`. ### Why are the changes needed? Gives operators a way to opt out of using the `proxy-user` cookie for AM UI view/modify ACLs in deployments where they prefer proxy requests to carry no user identity. Default preserves the existing behavior. ### Does this PR introduce _any_ user-facing change? No by default. A new opt-in config; when enabled, per-user AM UI ACLs through the proxy are disabled (proxy requests carry no user). ### How was this patch tested? New unit test in `AmIpFilterSuite` (cookie honored by default, ignored when the init parameter is false) plus `yarn/compile`. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Isaac This pull request and its description were written by Isaac. Co-authored-by: Isaac <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
