From efb623931a22ebe9c8bee6ed6d3be04db3d401d9 Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Sat, 29 Aug 2026 00:56:29 +0800 Subject: [PATCH 1/5] [KYUUBI #7676][DOCS] Recommend multi-tenant session config safeguards Signed-off-by: nightcityblade --- docs/security/authorization/spark/overview.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/security/authorization/spark/overview.md b/docs/security/authorization/spark/overview.md index 071e1b1b677..bdc8066207d 100644 --- a/docs/security/authorization/spark/overview.md +++ b/docs/security/authorization/spark/overview.md @@ -84,6 +84,14 @@ documentation [Spark Configurations](../../../configuration/settings.md#spark-co #### Restrict Session Level Config +:::{note} +For a multi-tenant Kyuubi deployment, administrators should configure at least +one of these lists: `kyuubi.session.conf.ignore.list` or +`kyuubi.session.conf.restrict.list`. +Both lists are empty by default, so clients can otherwise override sensitive +session-level configurations during engine bootstrap and connection setup. +::: + You can specify config `kyuubi.session.conf.ignore.list` values and config `kyuubi.session.conf.restrict.list` values to disable changing session+ level configuration on the server side. For example: From 44994a27fd33fc3f0b0e50c3b4348d7cbef1bd62 Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Sat, 29 Aug 2026 11:20:25 +0800 Subject: [PATCH 2/5] [KYUUBI #7676][DOCS] Add session config baseline --- docs/security/authorization/spark/overview.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/security/authorization/spark/overview.md b/docs/security/authorization/spark/overview.md index bdc8066207d..4947ef95436 100644 --- a/docs/security/authorization/spark/overview.md +++ b/docs/security/authorization/spark/overview.md @@ -94,15 +94,19 @@ session-level configurations during engine bootstrap and connection setup. You can specify config `kyuubi.session.conf.ignore.list` values and config `kyuubi.session.conf.restrict.list` values to disable changing session+ level -configuration on the server side. For example: +configuration on the server side. One conservative starting point is to keep +server-defined resource sizing while rejecting changes to deployment and +authorization settings: ```text -kyuubi.session.conf.ignore.list spark.driver.memory,spark.sql.optimizer.excludedRules +kyuubi.session.conf.ignore.list spark.driver.memory,spark.executor.memory +kyuubi.session.conf.restrict.list spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules ``` -```text -kyuubi.session.conf.restrict.list spark.driver.memory,spark.sql.optimizer.excludedRules -``` +Tailor this baseline to the deployment. The ignore list silently drops client +values, while the restrict list rejects the connection. These lists protect +engine bootstrap and connection setup only; use the operation-level restriction +below to prevent later changes through `SET` statements. #### Restrict Operation Level Config From 9bf6e91f8d5d38085442b9b3578bd23588afac2c Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Tue, 1 Sep 2026 11:05:50 +0800 Subject: [PATCH 3/5] docs: move session config guidance to security overview --- docs/security/authorization/spark/overview.md | 22 ++++------------- docs/security/index.md | 24 ++++++++++++++++++- 2 files changed, 28 insertions(+), 18 deletions(-) diff --git a/docs/security/authorization/spark/overview.md b/docs/security/authorization/spark/overview.md index 4947ef95436..071e1b1b677 100644 --- a/docs/security/authorization/spark/overview.md +++ b/docs/security/authorization/spark/overview.md @@ -84,29 +84,17 @@ documentation [Spark Configurations](../../../configuration/settings.md#spark-co #### Restrict Session Level Config -:::{note} -For a multi-tenant Kyuubi deployment, administrators should configure at least -one of these lists: `kyuubi.session.conf.ignore.list` or -`kyuubi.session.conf.restrict.list`. -Both lists are empty by default, so clients can otherwise override sensitive -session-level configurations during engine bootstrap and connection setup. -::: - You can specify config `kyuubi.session.conf.ignore.list` values and config `kyuubi.session.conf.restrict.list` values to disable changing session+ level -configuration on the server side. One conservative starting point is to keep -server-defined resource sizing while rejecting changes to deployment and -authorization settings: +configuration on the server side. For example: ```text -kyuubi.session.conf.ignore.list spark.driver.memory,spark.executor.memory -kyuubi.session.conf.restrict.list spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules +kyuubi.session.conf.ignore.list spark.driver.memory,spark.sql.optimizer.excludedRules ``` -Tailor this baseline to the deployment. The ignore list silently drops client -values, while the restrict list rejects the connection. These lists protect -engine bootstrap and connection setup only; use the operation-level restriction -below to prevent later changes through `SET` statements. +```text +kyuubi.session.conf.restrict.list spark.driver.memory,spark.sql.optimizer.excludedRules +``` #### Restrict Operation Level Config diff --git a/docs/security/index.md b/docs/security/index.md index eca34161887..053e9e27f0d 100644 --- a/docs/security/index.md +++ b/docs/security/index.md @@ -20,6 +20,29 @@ Securing Kyuubi involves enabling authentication(authn), authorization(authz) and encryption, etc. +## Protect Session Configurations + +For a multi-tenant deployment, configure at least one of +`kyuubi.session.conf.ignore.list` or `kyuubi.session.conf.restrict.list`. Both +lists are empty by default, so clients can otherwise override sensitive +session-level configurations during engine bootstrap and connection setup. + +One conservative starting point is to keep server-defined resource sizing while +rejecting client changes to deployment and authorization settings: + +```properties +kyuubi.session.conf.ignore.list=spark.driver.memory,spark.executor.memory +kyuubi.session.conf.restrict.list=spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules +``` + +Tailor these lists to the deployment. The ignore list silently drops matching +client values, while the restrict list rejects the connection. They do not +prevent later changes through `SET` statements; configure the engine's +operation-level restrictions separately when that protection is required. + +See the [session configuration settings](../configuration/settings.md#session) +for details. + ```{toctree} :maxdepth: 2 @@ -29,4 +52,3 @@ kinit hadoop_credentials_manager internal_secure_access ``` - From 95c480efda979493628ac1aaa1647904d2b4df34 Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Sun, 6 Sep 2026 23:06:25 +0800 Subject: [PATCH 4/5] docs: separate session configuration guidance --- docs/security/index.md | 24 +--------------- docs/security/session_configuration.md | 40 ++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 23 deletions(-) create mode 100644 docs/security/session_configuration.md diff --git a/docs/security/index.md b/docs/security/index.md index 053e9e27f0d..1208a771313 100644 --- a/docs/security/index.md +++ b/docs/security/index.md @@ -20,34 +20,12 @@ Securing Kyuubi involves enabling authentication(authn), authorization(authz) and encryption, etc. -## Protect Session Configurations - -For a multi-tenant deployment, configure at least one of -`kyuubi.session.conf.ignore.list` or `kyuubi.session.conf.restrict.list`. Both -lists are empty by default, so clients can otherwise override sensitive -session-level configurations during engine bootstrap and connection setup. - -One conservative starting point is to keep server-defined resource sizing while -rejecting client changes to deployment and authorization settings: - -```properties -kyuubi.session.conf.ignore.list=spark.driver.memory,spark.executor.memory -kyuubi.session.conf.restrict.list=spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules -``` - -Tailor these lists to the deployment. The ignore list silently drops matching -client values, while the restrict list rejects the connection. They do not -prevent later changes through `SET` statements; configure the engine's -operation-level restrictions separately when that protection is required. - -See the [session configuration settings](../configuration/settings.md#session) -for details. - ```{toctree} :maxdepth: 2 Authentication Authorization +Session Configuration kinit hadoop_credentials_manager internal_secure_access diff --git a/docs/security/session_configuration.md b/docs/security/session_configuration.md new file mode 100644 index 00000000000..b61f71b759d --- /dev/null +++ b/docs/security/session_configuration.md @@ -0,0 +1,40 @@ + + +# Protect Session Configurations + +For a multi-tenant deployment, configure at least one of +`kyuubi.session.conf.ignore.list` or `kyuubi.session.conf.restrict.list`. Both +lists are empty by default, so clients can otherwise override sensitive +session-level configurations during engine bootstrap and connection setup. + +One conservative starting point is: + +```properties +kyuubi.session.conf.ignore.list=spark.driver.memory,spark.executor.memory +kyuubi.session.conf.restrict.list=kyuubi.session.engine.spark.main.resource,kyuubi.engine.share.level,spark.master,spark.submit.deployMode,spark.sql.extensions,spark.sql.optimizer.excludedRules +``` + +This example is not comprehensive. Tailor both lists to the deployment. The +ignore list silently drops matching client values, while the restrict list +rejects the connection. Some settings are static or consumed during engine +startup and therefore cannot be changed later. For other settings, configure +the engine's operation-level restrictions when changes through `SET` statements +must also be prevented. + +See the [session configuration settings](../configuration/settings.md#session) +for details. From a861a77634a24a25f147ec108f290c5508839ae3 Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Tue, 8 Sep 2026 23:15:36 +0800 Subject: [PATCH 5/5] docs: fix security index formatting --- docs/security/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/security/index.md b/docs/security/index.md index 1208a771313..0c85c499164 100644 --- a/docs/security/index.md +++ b/docs/security/index.md @@ -30,3 +30,4 @@ kinit hadoop_credentials_manager internal_secure_access ``` +