We now have the spark-operator version 2.2.1 running on the dse-k8s-eqiad cluster.
There are two configured spark job namesapces (spark and analytics-test) where any created SparkApplication objects will be handled by the operator and executed as spark jobs.
The spark-operator helm chart creates several objects in each of these spark job namespaces. These enable the basic functionality of the spark-operator and include:
RBAC Roles
- role.rbac.authorization.k8s.io/production-spark-operator-controller
- role.rbac.authorization.k8s.io/production-spark-operator-webhook
- role.rbac.authorization.k8s.io/production-spark-operator-spark
RBAC Rolebindings
- rolebinding.rbac.authorization.k8s.io/production-spark-operator-controller
- rolebinding.rbac.authorization.k8s.io/production-spark-operator-webhook
- rolebinding.rbac.authorization.k8s.io/production-spark-operator-spark
A serviceaccount
- serviceaccount/production-spark-operator-spark
Network policies - Note that these networkpolicy objects are WMF additions to the spark-operator chart
- networkpolicy.crd.projectcalico.org/spark-driver-k8s-api
- networkpolicy.crd.projectcalico.org/spark-executor-to-driver
- networkpolicy.crd.projectcalico.org/spark-executor-to-executor
- networkpolicy.crd.projectcalico.org/spark-operator-webhook-to-driver
With these resources available, we can run a self-contained spark job such as the sparkPi example.
However, we cannot yet to the following:
- Authenticate using kerberos
- Connect to the hive metastore
- Connect to the HDFS file system
- Connect to our Ceph/S3 rados gateway
- Experiment with running spark-submit by-hand
Enabling this functionality will require more kubernetes resources to be installed into each of the spark job namespaces.
These will include:
- Network policies allowing egress to:
- Kerberos KDCs
- The Hive metastore
- The HDFS nameservers and datanodes
- The Ceph/S3 rados gateway
- Configmaps defining
- Common hadoop configuration
- Common spark configuration
- Secrets containing:
- A Kerberos keytab (containing one or more principals)
- Credentials for accessing the Ceph/S3 service
- Utility pod(s)
- A pod running a spark image, in which engineers can start a shell
One option would be to add all of these resources to the spark-operator helm chart, in the way that we have added the networkpolicy objects.
However, since we have recently switched to using the upstream chart, we would ideally like to keep modifications to this chart to a minimum.
Therefore, if we create a new chart that managees the resources we need for this, we can deploy a release of this chart into each spark-enabled namespace.