[jira] [Created] (SPARK-60345) Scope the _SPARK_SSL_RPC_* environment fallback in SSLOptions to the RPC namespace

["Florian Müller (Jira)" <ji...@apache.org>]

Florian Müller created SPARK-60345:
--------------------------------------

             Summary: Scope the _SPARK_SSL_RPC_* environment fallback in SSLOptions to the RPC namespace
                 Key: SPARK-60345
                 URL: https://issues.apache.org/jira/browse/SPARK-60345
             Project: Spark
          Issue Type: Bug
          Components: Spark Core
    Affects Versions: 4.3.0
            Reporter: Florian Müller


{{SSLOptions.parse}} falls back to the {{_SPARK_SSL_RPC_KEY_STORE_PASSWORD}}, {{_SPARK_SSL_RPC_KEY_PASSWORD}}, {{_SPARK_SSL_RPC_PRIVATE_KEY_PASSWORD}} and {{_SPARK_SSL_RPC_TRUST_STORE_PASSWORD}} environment variables for every namespace, not just {{spark.ssl.rpc.}} The lookup order is: the namespace's own conf key, then the Hadoop credential provider, then the env variable, then the {{spark.ssl.*}} defaults. So whenever these variables are set in a process, every enabled SSL namespace in that process resolves the RPC password ahead of the password it would otherwise inherit from {{spark.ssl.*}}. That includes {{spark.ssl}} itself, when {{spark.ssl.keyStorePassword}} is not set.

 

Proposed fix: Only consult the environment variables when {{ns == "spark.ssl.rpc"}}. parse already special-cases that namespace for {{enabledDefault}}. Within {{spark.ssl.rpc}}, keep the current lookup order.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org