Spark 3.5.0在Kubernetes上无法实例化外部调度器求助

已配置的权限资源信息 #

我已创建ServiceAccount和ClusterRoleBinding，为Spark Driver授予edit权限，相关资源描述如下：

kubectl describe clusterrolebinding/spark-driver-rolebinding  -n spark-application 
Name:         spark-driver-rolebinding
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  edit
Subjects:
  Kind            Name                          Namespace
  ----            ----                          ---------
  ServiceAccount  spark-driver-service-account  spark-application

kubectl describe serviceaccount/spark-driver-service-account  -n spark-application 
Name:                spark-driver-service-account
Namespace:           spark-application
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>

报错信息 #

使用Spark 3.5.0基础镜像提交应用后，Driver Pod立即进入错误状态，报错日志：

ERROR SparkContext: Error initializing SparkContext.
org.apache.spark.SparkException: External scheduler cannot be instantiated
        at org.apache.spark.SparkContext$.org$apache$spark$SparkContext$$createTaskScheduler(SparkContext.scala:3209)
        at org.apache.spark.SparkContext.<init>(SparkContext.scala:582)
        at org.apache.spark.SparkContext$.getOrCreate(SparkContext.scala:2888)
        at org.apache.spark.sql.SparkSession$Builder.$anonfun$getOrCreate$2(SparkSession.scala:1099)
        at scala.Option.getOrElse(Option.scala:189)
        at org.apache.spark.sql.SparkSession$Builder.getOrCreate(SparkSession.scala:1093)
        at com.inmobi.cob.extreporting.ExternalReportingController$.main(ExternalReportingController.scala:25)
        at com.inmobi.cob.extreporting.ExternalReportingController.main(ExternalReportingController.scala)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52)
        at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:1029)
        at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:194)
        at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:217)
        at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:91)
        at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:1120)
        at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:1129)
        at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
        at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
        at org.apache.spark.scheduler.cluster.k8s.KubernetesClusterManager.makeExecutorPodsAllocator(KubernetesClusterManager.scala:179)
        at org.apache.spark.scheduler.cluster.k8s.KubernetesClusterManager.createSchedulerBackend(KubernetesClusterManager.scala:133)
        at org.apache.spark.SparkContext$.org$apache$spark$SparkContext$$createTaskScheduler(SparkContext.scala:3203)
        ... 19 more

问题说明 #

此前了解到该类报错通常指向缺失edit权限，但我已完成对应权限配置，仍无法解决问题，恳请帮忙排查。

排查建议 #

• 检查ServiceAccount Token挂载：从描述结果看当前ServiceAccount无关联Token，确认Driver Pod的spec.serviceAccountName是否正确设置为spark-driver-service-account，同时集群是否开启了ServiceAccount Token自动挂载（默认开启，若手动关闭需重新启用）。
• 验证权限有效性：进入Driver Pod（若能启动到可执行命令状态），执行kubectl auth can-i create pods -n spark-application，确认是否拥有创建Pod的权限——这是Spark调度Executor必需的核心权限。
• 核对Spark提交参数：确保提交命令中指定了--conf spark.kubernetes.authenticate.driver.serviceAccountName=spark-driver-service-account和--conf spark.kubernetes.namespace=spark-application，保证Driver使用正确的身份访问K8s API。
• 检查权限范围冲突：确认是否存在其他RoleBinding或ClusterRoleBinding限制了该ServiceAccount的权限，比如是否有拒绝策略覆盖了edit角色的允许权限。
• 获取完整报错日志：当前日志仅显示上层异常，需查看Driver Pod的完整日志，找到InvocationTargetException的底层根异常（如权限拒绝Forbidden错误），这会明确指出具体缺失的权限或配置问题。

内容的提问来源于stack exchange，提问作者Sahana J C