AWS emr documentation change
Summary
Expanded documentation for the emr-job-submitter classification, adding support for pod labels, annotations, tolerations, custom scheduler, logging control, custom container image configuration, and updated examples.
Security assessment
The changes are feature enhancements adding new configuration options for job submitter pods (labels, annotations, tolerations, scheduler, logging control, custom images). There is no mention of security vulnerabilities, patches, or security incidents. The changes improve operational control but don't directly address security issues.
Diff
diff --git a/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-job-submitter.md b/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-job-submitter.md index 031ce682a..45fba1e44 100644 --- a//emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-job-submitter.md +++ b//emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-job-submitter.md @@ -11 +11 @@ OverviewExamples -The Amazon EMR on EKS `StartJobRun` request creates a _job submitter_ pod (also known as the _job-runner_ pod) to spawn the Spark driver. You can use `emr-job-submitter` classification to configure node selectors for your job submitter pod, as well as set the image, CPU, and memory for the job submitter pod’s logging container. +The Amazon EMR on EKS `StartJobRun` request creates a _job submitter_ pod (also known as the _job-runner_ pod) to spawn the Spark driver. You can use the `emr-job-submitter` classification to configure node selectors, add tolerations, customize logging, and make other modifications to the job submitter pod. @@ -15 +15 @@ The following settings are available under the `emr-job-submitter` classificatio -**`jobsubmitter.node.selector.[`labelKey`]`** +**`jobsubmitter.node.selector.[`selectorKey`]` ** @@ -18 +18,36 @@ The following settings are available under the `emr-job-submitter` classificatio -Adds to the node selector of the job submitter pod, with key ``labelKey`` and the value as the configuration value for the configuration. For example, you can set `jobsubmitter.node.selector.identifier` to `myIdentifier` and the job submitter pod will have a node selector with a key identifier value of `myIdentifier`. This can be used to specify which nodes the job submitter pod can be placed on. To add multiple node selector keys, set multiple configurations with this prefix. +Adds to the node selector of the job submitter pod, with key `selectorKey` and the value as the configuration value. For example, you can set ` jobsubmitter.node.selector.identifier` to `myIdentifier` and the job submitter pod will have a node selector with a key `identifier` and a value `myIdentifier`. This can be used to specify which nodes the job submitter pod can be placed on. To add multiple node selector keys, set multiple configurations with this prefix. + +**`jobsubmitter.label.[`labelKey`]` ** + + +Adds to the labels of the job submitter pod, with key `labelKey` and the value as the configuration value. To add multiple labels, set multiple configurations with this prefix. + +**`jobsubmitter.annotation.[`annotationKey`]` ** + + +Adds to the annotations of the job submitter pod, with key `annotationKey` and the value as the configuration value. To add multiple annotations, set multiple configurations with this prefix. + +**`jobsubmitter.node.toleration.[`tolerationKey`]` ** + + +Adds [ tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) to the job submitter pod. By default there are no tolerations added to the pod. The toleration's key will be `tolerationKey` and the toleration's value will be the configuration value. If the configuration value is set to a non-empty string, the operator will be `Equals`. If the configuration value is set to `""`, then the operator will be `Exists`. + +**`jobsubmitter.node.toleration.[`tolerationKey`].[`effect`]` ** + + +Adds a toleration effect to the prefixed `tolerationKey`. This field is required when adding tolerations. The allowed values for the effect field are ` NoExecute`, `NoSchedule`, and `PreferNoSchedule`. + +**`jobsubmitter.node.toleration.[`tolerationKey`].[`tolerationSeconds`]` ** + + +Adds tolerationSeconds to the prefixed `tolerationKey`. Optional field. Only applicable when the effect is `NoExecute`. + +**`jobsubmitter.scheduler.name` ** + + +Sets a custom schedulerName for the job submitter pod. + +**`jobsubmitter.logging` ** + + +Enables or disables logging on the job submitter pod. When this is set to ` DISABLED` the logging container is removed from the job submitter pod, which will disable any logging for this pod specified in the `monitoringConfiguration`, such as `s3MonitoringConfiguration` or `cloudWatchMonitoringConfiguration`. When this setting is not set or is set to any other value, logging on the job submitter pod is enabled. @@ -35 +70,11 @@ Sets a custom value for the amount of memory, in bytes, for the logging containe -We recommend to place job submitter pods on On-Demand Instances. Placing job submitter pods on Spot instances might result in a job failure if the instance where the job submitter pod runs is subject to a Spot Instance interruption. You can also place the job submitter pod in a single Availability Zone, or use any Kubernetes labels that are applied to the nodes. +**`jobsubmitter.container.image` ** + + +Sets a custom image for the job submitter pod's `job-runner` container. + +**`jobsubmitter.container.image.pullPolicy` ** + + +Sets the [imagePullPolicy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy) for the job submitter pod's containers. + +We recommend to place job submitter pods on On-Demand Instances. Placing job submitter pods on Spot instances might result in a job failure if the instance where the job submitter pod runs is subject to a Spot Instance interruption. You can also place the job submitter pod in a single Availability Zone or use any Kubernetes labels that are applied to the nodes. @@ -43 +88,3 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - * StartJobRun request with single-AZ node placement for the job submitter pod + * StartJobRun request with single-AZ node placement and Amazon EC2 instance type placement for the job submitter pod + + * StartJobRun request with labels, annotations, and a custom scheduler for the job submitter pod @@ -45 +92 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - * StartJobRun request with single-AZ and Amazon EC2 instance type placement for the job submitter pod + * StartJobRun request with a toleration applied to the job submitter pod with key dedicated, value graviton_machines, effect NoExecute, and a tolerationSeconds of 60 seconds @@ -47 +94 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - * StartJobRun request with custom logging container image, CPU, and memory + * StartJobRun request with logging disabled for the job submitter pod @@ -49 +96,3 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - * StartJobRun request with with custom container image + * StartJobRun request with custom logging container image, CPU, and memory for the job submitter pod + + * StartJobRun request with a custom job submitter container image and pull policy @@ -98 +147 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub -### `StartJobRun` request with single-AZ node placement for the job submitter pod +### `StartJobRun` request with single-AZ node placement and Amazon EC2 instance type placement for the job submitter pod @@ -101,12 +149,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - cat >spark-python-in-s3-nodeselector-job-submitter-az.json << EOF - { - "name": "spark-python-in-s3-nodeselector", - "virtualClusterId": "virtual-cluster-id", - "executionRoleArn": "execution-role-arn", - "releaseLabel": "emr-6.11.0-latest", - "jobDriver": { - "sparkSubmitJobDriver": { - "entryPoint": "s3://S3-prefix/trip-count.py", - "sparkSubmitParameters": "--conf spark.driver.cores=5 --conf spark.executor.memory=20G --conf spark.driver.memory=15G --conf spark.executor.cores=6" - } - }, @@ -115,6 +151,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - { - "classification": "spark-defaults", - "properties": { - "spark.dynamicAllocation.enabled":"false" - } - }, @@ -124 +155,2 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - "jobsubmitter.node.selector.topology.kubernetes.io/zone": "Availability Zone" + "jobsubmitter.node.selector.topology.kubernetes.io/zone": "Availability Zone", + "jobsubmitter.node.selector.node.kubernetes.io/instance-type":"m5.4xlarge" @@ -127,8 +159 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - ], - "monitoringConfiguration": { - "cloudWatchMonitoringConfiguration": { - "logGroupName": "/emr-containers/jobs", - "logStreamNamePrefix": "demo" - }, - "s3MonitoringConfiguration": { - "logUri": "s3://joblogs" + ] @@ -135,0 +161,14 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub + +### `StartJobRun` request with labels, annotations, and a custom scheduler for the job submitter pod + + + "configurationOverrides": { + "applicationConfiguration": [ + { + "classification": "emr-job-submitter", + "properties": { + "jobsubmitter.label.label1": "value1", + "jobsubmitter.label.label2": "value2", + "jobsubmitter.annotation.ann1": "value1", + "jobsubmitter.annotation.ann2": "value2", + "jobsubmitter.scheduler.name": "custom-scheduler" @@ -137,0 +177 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub + ] @@ -139,2 +178,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - EOF - aws emr-containers start-job-run --cli-input-json file:///spark-python-in-s3-nodeselector-job-submitter-az.json @@ -142 +180 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub -### `StartJobRun` request with single-AZ and Amazon EC2 instance type placement for the job submitter pod +### `StartJobRun` request with a toleration applied to the job submitter pod with key `dedicated`, value `graviton_machines`, effect `NoExecute`, and a `tolerationSeconds` of 60 seconds @@ -145,11 +182,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - { - "name": "spark-python-in-s3-nodeselector", - "virtualClusterId": "virtual-cluster-id", - "executionRoleArn": "execution-role-arn", - "releaseLabel": "emr-6.11.0-latest", - "jobDriver": { - "sparkSubmitJobDriver": { - "entryPoint": "s3://S3-prefix/trip-count.py", - "sparkSubmitParameters": "--conf spark.driver.cores=5 --conf spark.kubernetes.pyspark.pythonVersion=3 --conf spark.executor.memory=20G --conf spark.driver.memory=15G --conf spark.executor.cores=6 --conf spark.sql.shuffle.partitions=1000" - } - }, @@ -159 +186 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - "classification": "spark-defaults", + "classification": "emr-job-submitter", @@ -161 +188,3 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - "spark.dynamicAllocation.enabled":"false", + "jobsubmitter.node.toleration.dedicated":"graviton_machines", + "jobsubmitter.node.toleration.dedicated.effect":"NoExecute", + "jobsubmitter.node.toleration.dedicated.tolerationSeconds":"60" @@ -163 +192,9 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - }, + } + ] + } + +### `StartJobRun` request with logging disabled for the job submitter pod + + + "configurationOverrides": { + "applicationConfiguration": [ @@ -167,2 +204 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - "jobsubmitter.node.selector.topology.kubernetes.io/zone": "Availability Zone", - "jobsubmitter.node.selector.node.kubernetes.io/instance-type":"m5.4xlarge" + "jobsubmitter.logging": "DISABLED" @@ -182 +217,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - } @@ -184 +219 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub -### `StartJobRun` request with custom logging container image, CPU, and memory +### `StartJobRun` request with custom logging container image, CPU, and memory for the job submitter pod @@ -187,10 +221,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - { - "name": "spark-python", - "virtualClusterId": "virtual-cluster-id", - "executionRoleArn": "execution-role-arn", - "releaseLabel": "emr-6.11.0-latest", - "jobDriver": { - "sparkSubmitJobDriver": { - "entryPoint": "s3://S3-prefix/trip-count.py" - } - }, @@ -218 +242,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - } @@ -220 +244 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub -### `StartJobRun` request with with custom container image +### `StartJobRun` request with a custom job submitter container image and pull policy @@ -223,12 +246,0 @@ We recommend to place job submitter pods on On-Demand Instances. Placing job sub - cat >spark-python-in-s3-nodeselector-custom-container-image-job-submitter.json << EOF - { - "name": "spark-python-in-s3-nodeselector", - "virtualClusterId": "virtual-cluster-id", - "executionRoleArn": "execution-role-arn", - "releaseLabel": "emr-6.11.0-latest",