Managing Spark application permissions

Manage user access to Spark applications. The CQL resources for Spark applications are WORKPOOL and SUBMISSION. Create permissions on the workpool resource controls the ability of a user to submit a Spark application to DSE. Modify permissions on submission resource controls the ability of a user to manage and remove applications.

Procedure

Use CQL shell (cqlsh) to authorize access to DSE Resource Manager and Spark applications. All commands must be entered on a DSE Analytics node in the cluster.

Access to DSE Resource Manager:

GRANT EXECUTE ON REMOTE OBJECT DseResourceManager TO <role_name>;

Run applications:
```
GRANT EXECUTE ON REMOTE OBJECT DseClientTool TO <role_name>
```
Each DSE Analytics user must have permission to make remote procedure calls with DSE client tools.

For roles that are not superusers, access to the following tables is required:

GRANT SELECT ON system.size_estimates TO <role_name>;
GRANT SELECT ON "HiveMetaStore".sparkmetastore TO <role_name>;
GRANT MODIFY ON "HiveMetaStore".sparkmetastore TO <role_name>;

Submit applications:
- To all datacenters:
  GRANT CREATE ON ANY WORKPOOL TO <role_name>;
  Use revoke command to remove access:
  
  REVOKE CREATE ON ANY WORKPOOL FROM <role_name>;
- A particular datacenter:
  GRANT CREATE ON WORKPOOL <datacenter_name> TO <role_name>;
  Use revoke command to remove access:
  
  REVOKE CREATE ON WORKPOOL <datacenter_name> FROM <role_name>;
The role used to submit an application is automatically granted permission to MODIFY the application.

Modify applications:

All applications:

GRANT MODIFY ON ANY SUBMISSION TO <role_name>;

Use revoke command to remove access:

REVOKE MODIFY ON ANY SUBMISSION FROM <role_name>;

All applications in a particular datacenter:

GRANT MODIFY ON ANY SUBMISSION IN WORKPOOL <datacenter_name> TO <role_name>;

Use revoke command to remove access:

REVOKE MODIFY ON ANY SUBMISSION IN WORKPOOL <datacenter_name> FROM <role_name>;

Specific application in a particular datacenter:

GRANT MODIFY ON SUBMISSION <id> IN WORKPOOL <datacenter_name> TO <role_name>;

Use revoke command to remove access:

REVOKE MODIFY ON SUBMISSION <id> IN WORKPOOL <datacenter_name> FROM <role_name>;

Use DSE GraphFrames:

GRANT EXECUTE ON REMOTE OBJECT DseGraphRpc TO <role_name>;

View worker logs:

One of the following three permissions are required to view worker logs:
- GRANT DESCRIBE ON ANY SUBMISSION TO cassdev;
- GRANT DESCRIBE ON ANY SUBMISSION IN WORKPOOL 'datacenter_name.*' TO role_name;
- GRANT DESCRIBE ON SUBMISSION id IN WORKPOOL 'datacenter_name.*' TO role_name;

Managing Spark application permissions

Procedure

Was this helpful?

Give Feedback