Skip to content

Commit 6e7312a

Browse files
aaguminaagumin
authored
Merge pull request #5 from aagumin/feature/mtls
Feature/mtls
2 parents ce9e9f8 + a4ed512 commit 6e7312a

File tree

11 files changed

+174
-59
lines changed

11 files changed

+174
-59
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,3 +166,4 @@ cython_debug/
166166

167167
# custom values file
168168
charts/values.yaml
169+
charts/values-st2.yaml

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Spark Connect is an application that allows you to perform data processing tasks
1414
- [X] Dynamic package installation
1515
- [X] Apache Celeborn support
1616
- [ ] Optional mTLS.
17-
- [ ] Istio support
17+
- [ ] Istio support
1818

1919
## Requirements
2020

‎charts/spark-connect/templates/executor-pod-template-cm.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ data:
1212
name: spark-connect-kubernetes-executor
1313
labels:
1414
app.kubernetes.io/instance: {{ include "spark.name" . }}-executor
15+
{{ if .Values.mtls.enabled }}
16+
sidecar.istio.io/inject: "true"
17+
{{- end }}
1518
spark-role: executor
1619
{{- with .Values.spark.executor.labels }}
1720
{{- toYaml . | nindent 16 }}

‎charts/spark-connect/templates/spark-properties-cm.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,15 @@ data:
8282
spark.kubernetes.executor.request.cores {{ .Values.spark.executor.requestCoresMilliCPU }}m
8383
spark.kubernetes.local.dirs.tmpfs false
8484
spark.kubernetes.namespace {{ .Release.Namespace }}
85+
{{ if .Values.mtls.enabled }}
86+
spark.kubernetes.executor.service true
87+
spark.driver.bindAddress 0.0.0.0
88+
spark.driver.port 7078
89+
spark.blockManager.port 7079
90+
spark.executor.bindAddress 0.0.0.0
91+
spark.kubernetes.post.stop.script {{ .Values.mtls.poststopscript }}
92+
spark.kubernetes.pre.start.script {{ .Values.mtls.prestartscript }}
93+
{{- end }}
8594
{{- with .Values.spark.sparkConfig }}
8695
{{- range $key, $value := . }}
8796
{{ printf "%s %s" $key (toString $value) }}

‎charts/spark-connect/templates/stateful-set.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ spec:
1919
labels:
2020
{{- include "spark.selectorLabels" . | nindent 8 }}
2121
spark-driver-affinity-id: {{ uuidv4 | quote }}
22+
{{ if .Values.mtls.enabled}}
23+
sidecar.istio.io/inject: "true"
24+
{{- end }}
2225
spec:
2326
dnsConfig:
2427
options:

‎charts/spark-connect/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ extraEnv: []
7979

8080
mtls:
8181
enabled: false
82-
pre.start.script: ""
83-
post.stop.script: ""
82+
prestartscript: ""
83+
poststopscript: ""
8484

8585
containerPorts:
8686
sparkUi: 4040

‎docker/pom.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@
1818
<artifactId>celeborn-client-spark-3-shaded_2.12</artifactId>
1919
<version>0.5.1</version>
2020
</dependency>
21+
<!-- https://mvnrepository.com/artifact/org.apache.hadoop/hadoop-aws -->
22+
<dependency>
23+
<groupId>org.apache.hadoop</groupId>
24+
<artifactId>hadoop-aws</artifactId>
25+
<version>3.3.4</version>
26+
</dependency>
27+
2128
</dependencies>
2229
<build>
2330
<plugins>

‎mtls/Dockerfile‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
FROM eclipse-temurin:17 as builder
2+
3+
ENV MAVEN_OPTS="-Xss64m -Xmx2g -XX:ReservedCodeCacheSize=1g"
4+
ENV SPARK_VERSION=3.5.3
5+
ENV SPARK_HOME=/opt/spark
6+
ENV SPARK_TGZ_URL=https://archive.apache.org/dist/spark/spark-${SPARK_VERSION}/spark-${SPARK_VERSION}.tgz
7+
8+
WORKDIR /opt
9+
10+
RUN apt-get update; \
11+
apt-get install -y wget patch gettext-base gnupg2 bash tini libc6 libpam-modules krb5-user libnss3 procps net-tools gosu libnss-wrapper; \
12+
rm -rf /var/lib/apt/lists/*
13+
14+
15+
RUN set -ex; \
16+
mkdir -p $SPARK_HOME; \
17+
wget -nv -O /opt/spark.tgz "$SPARK_TGZ_URL"; \
18+
tar -zxf /opt/spark.tgz --strip-components=1 --directory=$SPARK_HOME; \
19+
rm /opt/spark.tgz
20+
21+
22+
WORKDIR $SPARK_HOME
23+
24+
COPY mtls/spark-40909.patch .
25+
RUN patch -p1 < $SPARK_HOME/spark-40909.patch
26+
27+
RUN ./dev/make-distribution.sh \
28+
--name spark-mtls \
29+
-Pconnect \
30+
-Pkubernetes \
31+
-Phadoop-3 \
32+
-Phadoop-cloud \
33+
-Pparquet-provided \
34+
-Phive \
35+
-Phive-thriftserver
36+
37+
## IMPORTANT! We must delete the spark-connect-commom jar from the jars directory!
38+
## see: https://issues.apache.org/jira/browse/SPARK-45201
39+
#RUN rm "${SPARK_HOME}/jars/spark-connect-common_${SCALA_VERSION}-${SPARK_VERSION}.jar"
40+
FROM python:3.10.14-slim-bookworm
41+
ARG spark_uid=185
42+
ENV SPARK_HOME=/opt/spark
43+
44+
RUN apt-get update; \
45+
apt-get install -y --no-install-recommends openjdk-17-jre tini procps gettext-base maven gettext-base curl; \
46+
rm -rf /var/lib/apt/lists/*
47+
48+
49+
RUN groupadd --system --gid=${spark_uid} spark && \
50+
useradd --system --uid=${spark_uid} --gid=spark spark
51+
52+
COPY --from=builder /opt/spark/dist/ ${SPARK_HOME}/
53+
54+
RUN chown -R spark:spark ${SPARK_HOME}/
55+
56+
RUN cp ${SPARK_HOME}/kubernetes/dockerfiles/spark/entrypoint.sh /opt/entrypoint.sh; \
57+
chmod a+x /opt/entrypoint.sh; \
58+
cp ${SPARK_HOME}/kubernetes/dockerfiles/spark/decom.sh /opt/decom.sh; \
59+
chmod a+x /opt/decom.sh
60+
61+
COPY mtls/scripts/wait_for_istio_sidecar.sh /opt/scripts/wait_for_istio_sidecar.sh
62+
RUN chmod +x /opt/scripts/wait_for_istio_sidecar.sh
63+
64+
COPY mtls/scripts/stop_istio_sidecar.sh /opt/scripts/stop_istio_sidecar.sh
65+
RUN chmod +x /opt/scripts/stop_istio_sidecar.sh
66+
67+
# switch to spark user
68+
69+
WORKDIR /opt
70+
COPY docker/pom.xml .
71+
72+
RUN mvn validate
73+
74+
RUN mvn install
75+
76+
RUN mvn dependency:copy-dependencies package
77+
78+
USER spark
79+
WORKDIR /home/spark
80+
81+
COPY docker/requirements.txt .
82+
RUN pip install -r requirements.txt
83+
84+
ENTRYPOINT ["/opt/entrypoint.sh"]

‎mtls/scripts/stop_istio_sidecar.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
# Define the namespace and pod name where the Istio sidecar is running
4+
5+
# Function to stop the Istio sidecar
6+
stop_istio_sidecar() {
7+
echo "Stopping Istio sidecar for pod"
8+
9+
# Send a termination signal to the istio-proxy sidecar
10+
curl -sf -XPOST 127.0.0.1:15000/quitquitquit
11+
12+
if [ $? -eq 0 ]; then
13+
echo "Istio sidecar stopped successfully."
14+
else
15+
echo "Failed to stop Istio sidecar."
16+
fi
17+
}
18+
19+
# Call the function to stop the sidecar
20+
stop_istio_sidecar

‎mtls/scripts/wait_for_istio_sidecar.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
3+
# Function to check if the Istio sidecar is ready
4+
is_sidecar_ready() {
5+
# Check if the sidecar proxy (Envoy) is running and ready
6+
curl -s http://localhost:15000/ready | grep "LIVE"
7+
}
8+
9+
# Wait for the sidecar proxy to be ready
10+
echo "Waiting for Istio sidecar to be ready..."
11+
until is_sidecar_ready; do
12+
echo "Sidecar not ready yet. Waiting..."
13+
sleep 3
14+
done
15+
16+
echo "Istio sidecar is ready."

0 commit comments

Comments
 (0)