Internet-Security.com TCP port 8998 details

Apache Livy (the REST server for Apache Spark) uses TCP port 8998 by default to submit and manage Spark jobs via HTTP/JSON.
Cloudera distributions (CDH/HDP/CDP) deploy Livy on 8998; tools like Hue and Apache Zeppelin connect to Livy at this port to run Spark notebooks.
Amazon EMR runs Livy on port 8998 on the master node; users often tunnel to :8998 to programmatically submit Spark jobs.
Azure HDInsight’s Spark clusters host Livy on 8998 on head nodes (typically internal-only) for REST-based Spark job submission.
Google Cloud Dataproc can enable Livy on 8998 to provide a REST endpoint for Spark in managed clusters.
Security note: Exposed Livy endpoints on 8998 (especially without authentication) have been abused by attackers and cryptomining botnets to execute arbitrary Spark code; restrict and authenticate access.

TCP 8998