Chandni Singh created SPARK-58926:
-------------------------------------
Summary: Driver pod SPARK_USER should be the proxy user, not the
submitter
Key: SPARK-58926
URL: https://issues.apache.org/jira/browse/SPARK-58926
Project: Spark
Issue Type: Bug
Components: Kubernetes
Affects Versions: 4.2.0
Reporter: Chandni Singh
When a Spark app is submitted on Kubernetes with --proxy-user alice, the driver
pod's SPARK_USER env var is set to the submitter (e.g. spark), not alice.
Anything in the driver JVM that reads SPARK_USER sees the wrong identity. That
includes SparkContext.sparkUser (event log ownership, UI attribution) and Spark
UI view/modify ACLs (SecurityManager). External authz systems (Ranger, custom
gRPC interceptors) that resolve identity through SPARK_USER inherit the same
wrong value.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
