This is an automated email from the ASF dual-hosted git repository.
davidzollo pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/seatunnel-website.git
The following commit(s) were added to refs/heads/main by this push:
new b22ac225a1a6 docs: clarify Zeta member-protocol trust boundary (#535)
b22ac225a1a6 is described below
commit b22ac225a1a63c02e3fa4617d23a9b453222e8b0
Author: Daniel <[email protected]>
AuthorDate: Fri Sep 11 14:42:43 2026 +0800
docs: clarify Zeta member-protocol trust boundary (#535)
---
src/pages/security/index.js | 2 ++
src/pages/security/languages.json | 4 ++++
2 files changed, 6 insertions(+)
diff --git a/src/pages/security/index.js b/src/pages/security/index.js
index 423225064eab..ef00ab0ebe00 100644
--- a/src/pages/security/index.js
+++ b/src/pages/security/index.js
@@ -35,6 +35,8 @@ export default function () {
<p
className="team_desc">{info.security_p_seatunnel_web_notice}</p>
<h3
className="team_title">{info.security_model_seatunnel_zeta_title}</h3>
<p
className="team_desc">{info.security_p_seatunnel_zeta_notice}</p>
+ <p
className="team_desc">{info.security_p_seatunnel_zeta_interfaces}</p>
+ <p
className="team_desc">{info.security_p_seatunnel_zeta_trust_boundary}</p>
{renderList(info.security_model_items)}
<h2 className="team_title">{info.deployment_title}</h2>
diff --git a/src/pages/security/languages.json
b/src/pages/security/languages.json
index 5370972ddc38..6490c463675a 100644
--- a/src/pages/security/languages.json
+++ b/src/pages/security/languages.json
@@ -13,6 +13,8 @@
"security_p_seatunnel_web_notice": "seatunnel-web delegates user
authentication to the surrounding deployment. Once a user is admitted,
SeaTunnel treats that user as having full administrative access. seatunnel-web
does not provide per-operation authorization checks for third-party SDK calls.",
"security_model_seatunnel_zeta_title": "seatunnel-zeta",
"security_p_seatunnel_zeta_notice": "SeaTunnel Engine management access
is administrative access. Any client that can reach a management interface
should be treated as a cluster administrator. SeaTunnel does not perform
additional authorization checks when those clients submit jobs or interact with
connectors, plugins, or third-party SDKs.",
+ "security_p_seatunnel_zeta_interfaces": "For Zeta, ‘management
interfaces’ means every network interface that accepts cluster-control traffic,
not only HTTP or job-submission APIs. The packaged configuration listens for
the Hazelcast member/client protocol on TCP port 5801 on hybrid and master
nodes and TCP port 5802 on separated worker nodes; deployments can change these
ports in hazelcast.yaml, hazelcast-master.yaml, and hazelcast-worker.yaml. When
enabled, the deprecated REST AP [...]
+ "security_p_seatunnel_zeta_trust_boundary": "The same administrative
trust boundary covers Hazelcast client-to-member and member-to-member traffic,
including worker-to-master and master-to-worker messages and packet decoding.
Every Zeta member, including every worker, must therefore be trusted as a
cluster administrator. A compromised worker, a process admitted as a member, or
a party with direct access to a member-protocol endpoint is already inside this
boundary; SeaTunnel does n [...]
"security_model_items": [
"SeaTunnel management interfaces are not intended to be exposed
directly to the public Internet.",
"SeaTunnel does not currently provide role-based access control
(RBAC), multi-tenant isolation, or per-user authorization for management
operations.",
@@ -53,6 +55,8 @@
"security_p_seatunnel_web_notice": "seatunnel-web
将用户认证交给外围部署体系处理。一旦用户被允许访问，SeaTunnel 会将其视为拥有完整管理权限的用户。seatunnel-web 不会针对第三方 SDK
调用提供逐操作授权检查。",
"security_model_seatunnel_zeta_title": "seatunnel-zeta",
"security_p_seatunnel_zeta_notice": "SeaTunnel Engine
的管理访问本质上就是管理员访问。任何能够到达管理接口的客户端，都应被视为集群管理员。SeaTunnel 不会在这些客户端提交作业或与连接器、插件、第三方
SDK 交互时再做额外授权检查。",
+ "security_p_seatunnel_zeta_interfaces": "对于
Zeta，‘管理接口’是指所有接收集群控制流量的网络接口，而不仅是 HTTP 或作业提交 API。发行包默认配置中，混合节点和 master 节点的
Hazelcast 成员/客户端协议监听 TCP 5801，独立 worker 节点监听 TCP 5802；部署方可以在
hazelcast.yaml、hazelcast-master.yaml 和 hazelcast-worker.yaml 中修改这些端口。启用后，已弃用的
REST API v1 与 Hazelcast 成员协议共用同一端口。REST API v2 和 Web UI 使用单独配置的 Jetty 端口，发行包的
seatunnel.yaml 通常配置为 8080。",
+ "security_p_seatunnel_zeta_trust_boundary": "同一管理信任边界也覆盖 Hazelcast
客户端到成员以及成员间流量，包括 worker 到 master、master 到 worker 的消息和数据包解码。因此，每个 Zeta 成员（包括所有
worker）都必须按集群管理员来信任。已被攻陷的
worker、获准作为成员加入的进程，或可直接访问成员协议端点的一方，都已经处于该信任边界内；SeaTunnel 不承诺将 master
与来自该边界内部的恶意协议输入隔离。如果报告以这些条件之一为前提，则必须说明攻击者如何从管理信任边界外获得该能力；仅在该前提成立后发生代码执行，并不构成跨越
SeaTunnel 安全边界。",
"security_model_items": [
"SeaTunnel 管理接口不适合直接暴露到公网。",
"SeaTunnel 当前不提供基于角色的访问控制（RBAC）、多租户隔离或面向管理操作的按用户细粒度授权。",
