Supports one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client resource with managed ACLs, e.g. Queue Access Control Lists [https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn- site/FairScheduler.html#Queue_Access_Control_Lists], from cluster managers Kubernetes (K8s) [https://kubernetes.io/] to create the Spark application; 2) a user account can only access data and metadata from a storage system, e.g. Apache Hadoop HDFS [https://hadoop.apache.org/doc

Supports one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client resource with managed ACLs, e.g. Queue Access Control Lists [https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn- site/FairScheduler.html#Queue_Access_Control_Lists], from cluster managers Kubernetes (K8s) [https://kubernetes.io/] to create the Spark application; 2) a user account can only access data and metadata from a storage system, e.g. Apache Hadoop HDFS [https://hadoop.apache.org/doc

one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client managed ACLs, e.g. Queue Access Control Lists, from cluster managers, e.g. Apache Hadoop YARN, Kubernetes (K8s) to create the Spark application; 2) a user account can only access data and metadata from a [spark] # Host of the Spark Thrift Server # For macOS users, use docker.for.mac.host.internal to access host network sql_server_host=docker.for.mac.host.internal # Port of the Spark Thrift Server sql_server_port=10009

one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client managed ACLs, e.g. Queue Access Control Lists, from cluster managers, e.g. Apache Hadoop YARN, Kubernetes (K8s) to create the Spark application; 2) a user account can only access data and metadata from a [spark] # Host of the Spark Thrift Server # For macOS users, use docker.for.mac.host.internal to access host network sql_server_host=docker.for.mac.host.internal # Port of the Spark Thrift Server sql_server_port=10009

Supports one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client resource with managed ACLs, e.g. Queue Access Control Lists [https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn- site/FairScheduler.html#Queue_Access_Control_Lists], from cluster managers Kubernetes (K8s) [https://kubernetes.io/] to create the Spark application; 2) a user account can only access data and metadata from a storage system, e.g. Apache Hadoop HDFS [https://hadoop.apache.org/doc

Supports one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client resource with managed ACLs, e.g. Queue Access Control Lists [https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn- site/FairScheduler.html#Queue_Access_Control_Lists], from cluster managers Kubernetes (K8s) [https://kubernetes.io/] to create the Spark application; 2) a user account can only access data and metadata from a storage system, e.g. Apache Hadoop HDFS [https://hadoop.apache.org/doc

one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client managed ACLs, e.g. Queue Access Control Lists, from cluster managers, e.g. Apache Hadoop YARN, Kubernetes (K8s) to create the Spark application; 2) a user account can only access data and metadata from a [spark] # Host of the Spark Thrift Server # For macOS users, use docker.for.mac.host.internal to access host network sql_server_host=docker.for.mac.host.internal # Port of the Spark Thrift Server sql_server_port=10009

one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client managed ACLs, e.g. Queue Access Control Lists, from cluster managers, e.g. Apache Hadoop YARN, Kubernetes (K8s) to create the Spark application; 2) a user account can only access data and metadata from a [spark] # Host of the Spark Thrift Server # For macOS users, use docker.for.mac.host.internal to access host network sql_server_host=docker.for.mac.host.internal # Port of the Spark Thrift Server sql_server_port=10009

one Spark application per account(SPA). 3. Supports QUEUE/NAMESPACE Access Control Lists (ACL) 4. Supports metadata & data Access Control Lists Users who have valid accounts could use all kinds of client managed ACLs, e.g. Queue Access Control Lists, from cluster managers, e.g. Apache Hadoop YARN, Kubernetes (K8s) to create the Spark application; 2) a user account can only access data and metadata from a [spark] # Host of the Spark Thrift Server # For macOS users, use docker.for.mac.host.internal to access host network sql_server_host=docker.for.mac.host.internal # Port of the Spark Thrift Server sql_server_port=10009

GATEWAY The Server module plays the role of a unified gateway. The server enables simplified, secure access to any cluster resource through an entry point to deploy different workloads for end(remote) users single entry, admin- istrators have a single point for configuration, security, and control of remote access to clusters. And end users have an improved experience with seamless data processing with any the trusted client identities to instantiate themselves. The resource acquirement and data and metadata access all happen within their own engine. Thus, cluster managers and storage providers can easily guarantee