Configure Ranger for Spark on Kubernetes using Helm

{
  "isEnabled": true,
  "type": "hive",
  "name": "spark_k8s", (1)
  "displayName": "spark_k8s",
  "description": "Test service for Spark in Kubernetes",
  "configs": {
    "username": "spark",
    "password": "bigdata",
    "ranger.plugin.audit.filters": "[ {'accessResult': 'DENIED', 'isAudited': true}, {'actions':['METADATA OPERATION'], 'isAudited': false}, {'users':['hive','hue'],'actions':['SHOW_ROLES'],'isAudited':false} ]",
    "jdbc.driverClassName": "org.apache.hive.jdbc.HiveDriver",
    "jdbc.url": "jdbc:hive2://ka-adh-2.ru-central1.internal:10002",
    "userstore.download.auth.users": "*",
    "tag.download.auth.users": "*",
    "policy.download.auth.users": "*"
  }
}

image:
  registry: "registry" (1)
  repository: "repository" (2)
  tag: "version"
  ## Specify a pullPolicy
  ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
  ##
  pullPolicy: "Always"
  ## Existing secret or secret to create to use for image pulling, they must exist in all product namespaces
  ##
  pullSecret:
    name: ""
    credentials: {}
#      registry: private-docker-registry
#      username: user
#      password: pass

#ServiceAccount name for Spark driver/executor pods
serviceAccountName: "spark-app"

#Application
#mainApplicationFile: path to the main app file (hdfs://, local://, etc.)
mainApplicationFile: "hdfs://adh/user/konstantin/test.py" (3)

#Restart policy on failure: Never or OnFailure
#When set to OnFailure, maxRetries must be specified
restartPolicy: ""

#Maximum number of Job restart attempts on failure
#Required when restartPolicy is OnFailure
#maxRetries:

#Seconds to keep a finished (Succeeded or Failed) SparkApplication CR around
#before it is automatically deleted. A Failed application with restart
#attempts remaining does not count as finished. Omit to keep finished CRs
#until explicit deletion; 0 deletes as soon as the terminal status is recorded.
#ttlSecondsAfterFinished: 3600 (4)

#mainClass: set only for JVM apps (e.g. SparkConnectServer)
#mainClass: "org.apache.spark.examples.SparkPi"


#Hadoop configurations
hadoopConfigsSecretName: "hadoop-conf" (5)

#Spark configurations. When set, this client-managed Secret is the complete
#Spark configuration source. If Ranger is enabled, include the ranger-spark-*.xml
#files in this Secret; the chart does not create a separate Ranger config Secret.
sparkConfigsSecretName: ""

#Kerberos (keytab mode), disabled by default.
#The referenced Secret must already exist and carry two keys: keytab + krb5.conf.
#Ticket-cache mode is CLI-only and is not exposed here.
#Extra confs (e.g. spark.kerberos.access.hadoopFileSystems) go under sparkConf.
kerberos: {}
#  principal: user@RU-CENTRAL1.INTERNAL
#  keytab:
#    secretName: spark-keytab

# Arguments passed to the main application class after the main file
args:
  - "10"

#Spark configuration
#Key/value map rendered into spec.sparkConf
# sparkConf: {}

#SSL / truststore settings. The referenced Secret must already exist;
#the operator mounts the stores at /etc/ssl.
#Enabled implicitly when secretName is set.
ssl: {}
#  secretName: "ca-store"
#  trustStoreKey: "truststore.jks"
#  keyStoreKey: "keystore.jks"
sparkConf:
  spark.sql.extensions: org.apache.kyuubi.plugin.spark.authz.ranger.RangerSparkExtension (6)


#Ranger authorization (Kyuubi Spark Authz plugin), disabled by default.
#When enabled without sparkConfigsSecretName, the chart renders the
#ranger-spark-*.xml config Secret. The spark-apps.sparkConf helper always appends
#the Ranger extension to spark.sql.extensions.
#The audit JAAS block is written only when the kerberos block is set (keytab mode);
#the policymgr-ssl truststore is rendered only when ssl.enabled.
ranger:
  enabled: true
  # ranger.plugin.spark.policy.rest.url
  policyRestURL: "http://ka-adps-1.ru-central1.internal:6080" (7)
  # ranger.plugin.spark.service.name
  serviceName: "spark_k8s" (8)
  # xasecure.audit.destination.solr.zookeepers
  ranger.plugin.spark.use.rangerGroups: "True"
  ranger.plugin.spark.use.only.rangerGroups: "True"
  solrZookeepers: "ka-adps-1.ru-central1.internal:2181/Arenadata.Hadoop-43.solr.server" (9)


job:
  ## @param replicas set number of job replicas
  ##
  replicas: 1

  ## When false, the spark-submit Job pod is not automatically deleted after completion (useful for log inspection)
  ##
  #deleteOnTermination: false

  ## Additional configuration that you want to be added to job-config
  args: {}
  #  "task.max-worker-threads": 8

  ## Annotations for job pods
  annotations: {}

  ## Set container requests and limits for resource like CPU or memory (essential for production workloads)
  ##
  resources: {}
    #limits:
    #  cpu: "2"
    #  memory: "8Gi"
    #requests:
    #  cpu: "2"
  #  memory: "8Gi"

  ## Request additional PVC for pod
  ##
  persistentVolume: {}
  #  mountPath: "/data/spark"
  #  volumeClaimTemplates:
  #    - metadata:
  #        name: data
  #      spec:
  #        accessModes: ["ReadWriteOnce"]
  #        resources:
  #          requests:
  #            storage: 10Gi
  #        storageClassName: default

  ## nodeAffinity: Object defining constraints to place pods on a specific set of Nodes
  ##
  nodeSelector: {}

  topologySpreadConstraints: []

  ## Allow a Pod to be scheduled onto nodes that have taints.
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []
    # - key: "example-key"
    #   operator: "Exists"
  #   effect: "NoSchedule"

  ## affinity: Object defining soft rules to place pods on a specific set of Nodes or didn't place pod to nodes due to some conditions
  ##
  affinity: {}
  #  nodeAffinity:
  #      requiredDuringSchedulingIgnoredDuringExecution:
  #        nodeSelectorTerms:
  #        - matchExpressions:
  #          - key: topology.kubernetes.io/zone
  #            operator: In
  #            values:
  #            - antarctica-east1
  #            - antarctica-west1
  #      preferredDuringSchedulingIgnoredDuringExecution:
  #      - weight: 1
  #        preference:
  #          matchExpressions:
  #          - key: another-node-label-key
  #            operator: In
  #            values:
  #            - another-node-label-value

  startupProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  livenessProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  readinessProbe: {}
  #  type: exec
  #  command: test -f /opt/spark/etc/truststore/custom-truststore.jks
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  ## Mount additional secrets into the pod
  ##
  mountSecrets: []
  #  - secretName: my-secret
  #    mountPath: /etc/spark/my-secret

driver:
  ## @param replicas set number of driver replicas
  ##
  replicas: 1

  ## Additional configuration that you want to be added to driver-config
  args: {}
  #  "task.max-worker-threads": 8

  ## Annotations for driver pods
  annotations: {}

  ## Set container requests and limits for resource like CPU or memory (essential for production workloads)
  ##
  resources: {}
    #limits:
    #  cpu: "2"
    #  memory: "8Gi"
    #requests:
    #  cpu: "2"
  #  memory: "8Gi"

  ## Request additional PVC for pod
  ##
  persistentVolume: {}
  #  mountPath: "/data/spark"
  #  volumeClaimTemplates:
  #    - metadata:
  #        name: data
  #      spec:
  #        accessModes: ["ReadWriteOnce"]
  #        resources:
  #          requests:
  #            storage: 10Gi
  #        storageClassName: default

  ## nodeAffinity: Object defining constraints to place pods on a specific set of Nodes
  ##
  nodeSelector: {}

  topologySpreadConstraints: []

  ## Allow a Pod to be scheduled onto nodes that have taints.
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []
    # - key: "example-key"
    #   operator: "Exists"
  #   effect: "NoSchedule"

  ## affinity: Object defining soft rules to place pods on a specific set of Nodes or didn't place pod to nodes due to some conditions
  ##
  affinity: {}
  #  nodeAffinity:
  #      requiredDuringSchedulingIgnoredDuringExecution:
  #        nodeSelectorTerms:
  #        - matchExpressions:
  #          - key: topology.kubernetes.io/zone
  #            operator: In
  #            values:
  #            - antarctica-east1
  #            - antarctica-west1
  #      preferredDuringSchedulingIgnoredDuringExecution:
  #      - weight: 1
  #        preference:
  #          matchExpressions:
  #          - key: another-node-label-key
  #            operator: In
  #            values:
  #            - another-node-label-value

  startupProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  livenessProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  readinessProbe: {}
  #  type: exec
  #  command: test -f /opt/spark/etc/truststore/custom-truststore.jks
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  ## Mount additional secrets into the pod
  ##
  mountSecrets: []
  #  - secretName: my-secret
  #    mountPath: /etc/spark/my-secret

executor:
  ## @param replicas set number of executor replicas
  ##
  replicas: 1

  ## Additional configuration that you want to be added to executor-config
  args: {}
  #  "task.max-worker-threads": 8

  ## Annotations for executor pods
  annotations: {}

  ## Set container requests and limits for resource like CPU or memory (essential for production workloads)
  ##
  resources: {}
    #limits:
    #  cpu: "2"
    #  memory: "8Gi"
    #requests:
    #  cpu: "2"
  #  memory: "8Gi"

  ## Request additional PVC for pod
  ##
  persistentVolume: {}
  #  mountPath: "/data/spark"
  #  volumeClaimTemplates:
  #    - metadata:
  #        name: data
  #      spec:
  #        accessModes: ["ReadWriteOnce"]
  #        resources:
  #          requests:
  #            storage: 10Gi
  #        storageClassName: default

  ## nodeAffinity: Object defining constraints to place pods on a specific set of Nodes
  ##
  nodeSelector: {}

  topologySpreadConstraints: []

  ## Allow a Pod to be scheduled onto nodes that have taints.
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []
    # - key: "example-key"
    #   operator: "Exists"
  #   effect: "NoSchedule"

  ## affinity: Object defining soft rules to place pods on a specific set of Nodes or didn't place pod to nodes due to some conditions
  ##
  affinity: {}
  #  nodeAffinity:
  #      requiredDuringSchedulingIgnoredDuringExecution:
  #        nodeSelectorTerms:
  #        - matchExpressions:
  #          - key: topology.kubernetes.io/zone
  #            operator: In
  #            values:
  #            - antarctica-east1
  #            - antarctica-west1
  #      preferredDuringSchedulingIgnoredDuringExecution:
  #      - weight: 1
  #        preference:
  #          matchExpressions:
  #          - key: another-node-label-key
  #            operator: In
  #            values:
  #            - another-node-label-value

  startupProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  livenessProbe: {}
  #  type: httpGet
  #  port: 8080
  #  path: /v1/info
  #  scheme: HTTP
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  readinessProbe: {}
  #  type: exec
  #  command: test -f /opt/spark/etc/truststore/custom-truststore.jks
  #  initialDelaySeconds: 20
  #  periodSeconds: 5
  #  timeoutSeconds: 3
  #  successThreshold: 1
  #  failureThreshold: 2

  ## Mount additional secrets into the pod
  ##
  mountSecrets: []
  #  - secretName: my-secret
  #    mountPath: /etc/spark/my-secret


#Optional: inline Secret for properties-file pattern
propertiesFile:
  enabled: false
  # Raw content rendered into the Secret's stringData
  content: ""

#RBAC
rbac:
  # Set to false if the ServiceAccount/Role/RoleBinding already exist
  create: true
  rules:
    - apiGroups:
        - ""
      resources:
        - pods
        - configmaps
        - persistentvolumeclaims
        - services
        - secrets
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
        - delete
        - deletecollection
    - apiGroups:
        - networking.k8s.io
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
        - delete
      resources:
        - networkpolicies