always filter out auth secret

Author: kanzhang

core/src/main/scala/org/apache/spark/deploy/worker/CommandUtils.scala

@@ -91,20 +91,14 @@ object CommandUtils extends Logging {
     if (securityMgr.isAuthenticationEnabled) {
       newEnvironment += (SecurityManager.ENV_AUTH_SECRET -> securityMgr.getSecretKey)
     }
-    // filter out auth secret from java opts
-    val javaOpts = if (securityMgr.isAuthenticationEnabled) {
-      command.javaOpts.filterNot(_.startsWith("-D" + SecurityManager.SPARK_AUTH_SECRET_CONF))
-    } else {
-      command.javaOpts
-    }
 
     Command(
       command.mainClass,
       command.arguments.map(substituteArguments),
       newEnvironment,
       command.classPathEntries ++ classPath,
       Seq[String](), // library path already captured in environment variable
-      javaOpts)
+      command.javaOpts.filterNot(_.startsWith("-D" + SecurityManager.SPARK_AUTH_SECRET_CONF)))
   }
 
   /** Spawn a thread that will redirect a given stream to a file */

core/src/test/scala/org/apache/spark/deploy/worker/CommandUtilsSuite.scala

@@ -36,13 +36,14 @@ class CommandUtilsSuite extends SparkFunSuite with Matchers with PrivateMethodTe
     assert(env.get(libraryPath).startsWith("libraryPathToB"))
   }
 
-  test("Auth secret shouldn't appear in java opts") {
+  test("auth secret shouldn't appear in java opts") {
     val buildLocalCommand = PrivateMethod[Command]('buildLocalCommand)
-    val command = new Command("mainClass", Seq(), Map(), Seq(), Seq("libraryPathToB"), Seq())
     val conf = new SparkConf
-    // set auth secret
     val secret = "This is the secret sauce"
+    // set auth secret
     conf.set(SecurityManager.SPARK_AUTH_SECRET_CONF, secret)
+    val command = new Command("mainClass", Seq(), Map(), Seq(), Seq("lib"),
+      Seq("-D" + SecurityManager.SPARK_AUTH_SECRET_CONF + "=" + secret))
 
     // auth is not set
     var cmd = CommandUtils invokePrivate buildLocalCommand(