it's not possible to set securityContext.seccompProfile in SparkApplication

[gannulka]

What happened?

• ✋ I have searched the open/closed issues and my issue is not listed.

WIth the latest installed spark-operatot helm chart (v2.1.0) and activated webhook (by default) it's not possible to deploy SparkApplication (apiVersion: sparkoperator.k8s.io/v1beta2) with

driver:
   securityContext:
       seccompProfile:
           type: RuntimeDefault

the same for

executor:
   securityContext:
       seccompProfile:
           type: RuntimeDefault

Error is

strict decoding error: unknown field "spec.driver.securityContext.seccompProfile"

spark-operator-webhook doesn't contain any errors or logs specific to this timestamp.

Reproduction Code

Deploy SparkApplication with

driver:
   securityContext:
       seccompProfile:
           type: RuntimeDefault

or

driver:
   podSecurityContext:
       seccompProfile:
           type: RuntimeDefault

or

executor:
   securityContext:
       seccompProfile:
           type: RuntimeDefault

or

executor:
   podSecurityContext:
       seccompProfile:
           type: RuntimeDefault

Expected behavior

Webhook should allow this field according to documentation https://github.com/kubeflow/spark-operator/blob/master/docs/api-docs.md#sparkoperator.k8s.io/v1beta2.SparkPodSpec

Actual behavior

Error is

strict decoding error: unknown field "spec.driver.securityContext.seccompProfile"

Environment & Versions

• Kubernetes Version: 1.30
• Spark Operator Version: 2.1.0
• Apache Spark Version: 3.2.2

Additional context

No response

Impacted by this bug?

Give it a 👍 We prioritize the issues with most 👍

[ChenYi015]

@gannulka Driver/executor securityContext can be configured with pod template feature since v2.1.0, for example, see: https://github.com/kubeflow/spark-operator/blob/a348b9218fd6e718152fbd95f4d20425a4bc65e6/examples/spark-pi-pod-template.yaml.

[gannulka]

@gannulka Driver/executor securityContext can be configured with pod template feature since v2.1.0, for example, see: https://github.com/kubeflow/spark-operator/blob/a348b9218fd6e718152fbd95f4d20425a4bc65e6/examples/spark-pi-pod-template.yaml.

Sorry, but the sample doesn't contain securityContext definition. Anyway I can confirm that it's possible to set SOME settings from securityContext, but not seccomProfile. Exactly about securityContext.seccomProfile this issue is about.

[ChenYi015]

@gannulka Field.spec.[driver|executor].template is a PodTempalteSpec, it is possible to set almost everything of the spark pod except for the resource requirements. You can use spec.[driver|executor].template.spec.securityContext.seccomProfile to configure the seccomProfile.