Skip to content

[SPARK-27022][DSTREAMS] Add kafka delegation token support.#23929

Closed
gaborgsomogyi wants to merge 3 commits intoapache:masterfrom
gaborgsomogyi:SPARK-27022
Closed

[SPARK-27022][DSTREAMS] Add kafka delegation token support.#23929
gaborgsomogyi wants to merge 3 commits intoapache:masterfrom
gaborgsomogyi:SPARK-27022

Conversation

@gaborgsomogyi
Copy link
Contributor

@gaborgsomogyi gaborgsomogyi commented Mar 1, 2019

What changes were proposed in this pull request?

It adds Kafka delegation token support for DStreams. Please be aware as Kafka native sink is not available for DStreams this PR contains delegation token usage only on consumer side.

What this PR contains:

  • Usage of token through dynamic JAAS configuration
  • KafkaConfigUpdater moved to kafka-0-10-token-provider
  • KafkaSecurityHelper functionality moved into KafkaTokenUtil
  • Documentation

How was this patch tested?

Existing unit tests + on cluster.

Long running Kafka to file tests on 4 node cluster with randomly thrown artificial exceptions.

Test scenario:

  • 4 node cluster
  • Yarn
  • Kafka broker version 2.1.0
  • security.protocol = SASL_SSL
  • sasl.mechanism = SCRAM-SHA-512

Kafka broker settings:

  • delegation.token.expiry.time.ms=600000 (10 min)
  • delegation.token.max.lifetime.ms=1200000 (20 min)
  • delegation.token.expiry.check.interval.ms=300000 (5 min)

After each 7.5 minutes new delegation token obtained from Kafka broker (10 min * 0.75).
When token expired after 10 minutes (Spark obtains new one and doesn't renew the old), the brokers expiring thread comes after each 5 minutes (invalidates expired tokens) and artificial exception has been thrown inside the Spark application (such case Spark closes connection), then the latest delegation token picked up correctly.

cd docs/
SKIP_API=1 jekyll build
Manual webpage check.

@SparkQA
Copy link

SparkQA commented Mar 1, 2019

Test build #102916 has finished for PR 23929 at commit 647e40f.

  • This patch passes all tests.
  • This patch merges cleanly.
  • This patch adds no public classes.

@gaborgsomogyi
Copy link
Contributor Author

cc @vanzin

Copy link
Contributor

@vanzin vanzin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the any documentation to update? Better do that here if needed.

@gaborgsomogyi
Copy link
Contributor Author

Is the any documentation to update? Better do that here if needed.

Since its a small change and don't expect heavy architectural changes absolutely make sense, adding...

@SparkQA
Copy link

SparkQA commented Mar 5, 2019

Test build #103041 has finished for PR 23929 at commit 6978b57.

  • This patch passes all tests.
  • This patch merges cleanly.
  • This patch adds no public classes.

@SparkQA
Copy link

SparkQA commented Mar 7, 2019

Test build #103139 has finished for PR 23929 at commit 07bb716.

  • This patch passes all tests.
  • This patch merges cleanly.
  • This patch adds no public classes.

@vanzin
Copy link
Contributor

vanzin commented Mar 7, 2019

Merging to master.

@vanzin vanzin closed this in 98a8725 Mar 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants