[DOCS][SPARK-674] Documented user access to Spark Dispatcher instance…

… secrets. (apache#280)
Adikteev · Mar 6, 2018 · 8658312 · 8658312
1 parent 0b8fc01
commit 8658312
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/docs/limitations.md b/docs/limitations.md
@@ -21,7 +21,11 @@ featureMaturity:
 *   With Spark SSL/TLS enabled, if you specify environment-based secrets with
     `spark.mesos.[driver|executor].secret.envkeys, the keystore and truststore secrets will also show up as
     environment-based secrets, due to the way secrets are implemented. You can ignore these extra environment variables.
-
+
+*   Anyone who has access to the Spark (Dispatcher) service instance has access to all secrets available to it. Do not
+    grant users access to the Spark Dispatcher instance unless they are also permitted to access all secrets available
+    to the Spark Dispatcher instance.
+
 *   When using Kerberos and HDFS, the Spark Driver generates delegation tokens and distributes them to it's Executors
     via RPC.  Authentication of the Executors with the Driver is done with a [shared
     secret][https://spark.apache.org/docs/latest/security.html#spark-security]. Without authentication, it is possible

diff --git a/docs/security.md b/docs/security.md
@@ -29,6 +29,11 @@ that matches the name of the Spark service (e.g. `spark/secret`).  See the [Secr
 Documentation about Spaces][13] for details about how secret paths restrict
 service access to secrets.
 
+### Limitations
+Anyone who has access to the Spark (Dispatcher) service instance has access to all secrets available to it. Do not
+grant users access to the Spark Dispatchers instance unless they are also permitted to access all secrets available
+to the Spark Dispatcher instance.
+
 ### Binary Secrets
 
 When you need to store binary files into DC/OS secrets store, for example a Kerberos keytab file, your file needs to be base64-encoded as specified in RFC 4648.