[SPARK-32235] Kubernetes Configuration to set Service Account to Executors

• Type: Sub-task
• Status: Closed
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: 3.0.0
• Component/s: Kubernetes
• Assignee: Unassigned
• Reporter: Pedro Rossi
• Created: 08/Jul/20 21:35
• Updated: 26/Sep/20 23:35
• Resolved: 26/Sep/20 23:35

Description

Some cloud providers use Service Accounts to provide resource authorization (one example is described here https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/) and for this we need to be able to set Service Accounts to the executors.

My idea for development of this feature would be to have a configuration like "spark.kubernetes.authenticate.executor.serviceAccountName" in order to set the executors Service Account, this way it could be possible to allow only certain accesses to the driver and others to the executors or the same access (user's choice).

I am creating this issue so the maintainers can write opinions first, but I intend to create a pull request to address this issue also.

Issue Links

• is fixed by: SPARK-30122 Allow setting serviceAccountName for executor pods