apache-spark - 运行 spark-submit 命令时无法将 "spark"设置为服务帐户名称

Question

我在我的 mac 终端中运行这个命令，想将我的测试 spark 作业提交到我们的 k8s 集群之一:

ID_TOKEN=`kubectl config view --minify -o jsonpath='{.users[0].user.auth-provider.config.id-token}'`

./bin/spark-submit \
    --master k8s://https://c2.us-south.containers.cloud.ibm.com:30326 \
    --deploy-mode cluster \
    --name Hello \
    --class scala.example.Hello \
    --conf spark.kubernetes.namespace=isap \
    --conf spark.executor.instances=3 \
    --conf spark.kubernetes.container.image.pullPolicy=Always \
    --conf spark.kubernetes.container.image.pullSecrets=default-us-icr-io \
    --conf spark.kubernetes.container.image=us.icr.io/cedp-isap/spark-for-apps:2.4.1 \
    --conf spark.kubernetes.authenticate.driver.serviceAccountName=spark \
    --conf spark.kubernetes.authenticate.driver.caCertFile=/usr/local/opt/spark/ca.crt \
    --conf spark.kubernetes.authenticate.submission.oauthToken=$ID_TOKEN \
    local:///opt/spark/jars/interimetl_2.11-1.0.jar

我已经创建了服务帐户“spark”，以及集群角色绑定(bind) yaml，如下所示:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: isap
  name: pod-mgr
rules:
- apiGroups: ["rbac.authorization.k8s.io", ""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list", "create", "delete"]

和

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pod-mgr-spark
  namespace: isap
subjects:
- kind: ServiceAccount
  name: spark
  namespace: isap
roleRef:
  kind: ClusterRole
  name: pod-mgr
  apiGroup: rbac.authorization.k8s.io

但是当我运行 spark-submit 命令时，我发现日志是这样的:

20/06/15 02:45:02 INFO LoggingPodStatusWatcherImpl: State changed, new state: 
 pod name: hello-1592203500709-driver
 namespace: isap
 labels: spark-app-selector -> spark-0c7f50ab2d21427aac9cf2381cb4bb64, spark-role -> driver
 pod uid: 375674d2-784a-4b32-980d-953488c8a8b2
 creation time: 2020-06-15T06:45:02Z
 service account name: default
 volumes: kubernetes-credentials, spark-local-dir-1, spark-conf-volume, default-token-p8pgf
 node name: N/A
 start time: N/A
 container images: N/A
 phase: Pending
 status: []

您会注意到它仍在使用服务帐户“默认”，而不是“Spark”
并且无法在我的 k8s 集群中创建执行器 pod。在创建的驱动程序 Pane 中也不会显示任何日志。

谁能帮忙看看我在这里错过了什么？谢谢!

Answer 1

来自 docs您需要使用服务帐号spark作为触发提交的参数

--conf spark.kubernetes.authenticate.driver.serviceAccountName=spark