aajisaka commented on code in PR #7677: URL: https://github.com/apache/kyuubi/pull/7677#discussion_r3943440632
########## docs/security/index.md: ########## @@ -20,6 +20,29 @@ Securing Kyuubi involves enabling authentication(authn), authorization(authz) and encryption, etc. +## Protect Session Configurations + +For a multi-tenant deployment, configure at least one of +`kyuubi.session.conf.ignore.list` or `kyuubi.session.conf.restrict.list`. Both +lists are empty by default, so clients can otherwise override sensitive +session-level configurations during engine bootstrap and connection setup. + +One conservative starting point is to keep server-defined resource sizing while +rejecting client changes to deployment and authorization settings: + +```properties +kyuubi.session.conf.ignore.list=spark.driver.memory,spark.executor.memory +kyuubi.session.conf.restrict.list=spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules Review Comment: These parameters are not a good example for security. For example, I would like to add `kyuubi.session.engine.spark.main.resource` to restrict overriding the main class and add `kyuubi.engine.share.level` to restrict overriding the share level, also `spark.submit.deployMode` to ensure client use the expected deploy mode. Also please mention this example is not a comprehensive list. ########## docs/security/index.md: ########## @@ -20,6 +20,29 @@ Securing Kyuubi involves enabling authentication(authn), authorization(authz) and encryption, etc. +## Protect Session Configurations + +For a multi-tenant deployment, configure at least one of +`kyuubi.session.conf.ignore.list` or `kyuubi.session.conf.restrict.list`. Both +lists are empty by default, so clients can otherwise override sensitive +session-level configurations during engine bootstrap and connection setup. + +One conservative starting point is to keep server-defined resource sizing while +rejecting client changes to deployment and authorization settings: + +```properties +kyuubi.session.conf.ignore.list=spark.driver.memory,spark.executor.memory +kyuubi.session.conf.restrict.list=spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules +``` + +Tailor these lists to the deployment. The ignore list silently drops matching +client values, while the restrict list rejects the connection. They do not +prevent later changes through `SET` statements; configure the engine's +operation-level restrictions separately when that protection is required. Review Comment: > They do not prevent later changes through `SET` statements; configure the engine's operation-level restrictions separately when that protection is required. This is not always true. If the config is static or used in other module (e.g. yarn/core), it's never updated. Reference: https://kyuubi.readthedocs.io/en/master/monitor/troubleshooting.html#failed-to-start-spark-3-1-or-above-version-with-error-msg-cannot-modify-the-value-of-a-spark-config -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
