Spark Over a Mesos Secured Productive Environment
summary
Stratio modifies Spark on Mesos to add Kerberos authentication, dynamic delegation tokens and Vault-backed secret provisioning so no master keys hit container logs, and implements one-time Vault tokens passed from driver to executors. Mutual TLS support is added for TLS-only stores and a PKCS#8 conversion path; network isolation uses Calico network profiles so drivers, executors and services have distinct ACLs. Live demo runs on a 200-core, 1 TB cluster showing authorized jobs succeed and policy-blocked jobs fail, with negligible performance overhead.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:43Presentation Outline
- 2:04Presentation Introduction
- 2:41Marcos Introduction
- 4:50What is DCOs
- 5:33Preconditions
- 6:55Integration
- 9:56Kerberos
- 12:03HDFS
- 12:47Read from HDFS
- 14:22Key management
- 15:29Security
- 16:49Security Problem
- 19:41mundial
- 20:00Mutual TLS
- 21:11TLS in Wikipedia
- 21:40We think different
- 22:30Demo
- 25:45Never Isolation
- 26:50Network Solution
- 28:31Network Profiling
- 32:08Life Demo
- 32:44Spark Dispatch
- 33:18Access HDFS
- 39:04Network Parameters
- 39:29Spark Properties
- 40:33Questions
related talks
37mScaling and Securing Spark on Kubernetes at Bloomberg
32mReal Security for Services on Kubernetes [I]
55mHigh performance Privacy By Design using Matryoshka & Spark
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
01h 05mTutorial: Demystifying and Enabling Workload Identity Across the Cloud Native Ecosystem
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
31mModern Security with Microservices and the Cloud
23mApache Spark meets FIPS standard