[
https://issues.apache.org/jira/browse/FLINK-17641?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17236289#comment-17236289
]
Ethan Li edited comment on FLINK-17641 at 11/20/20, 5:06 PM:
-------------------------------------------------------------
Thanks very much for your reply [~rmetzger]. The suggestions are helpful.
Sorry I haven't been able to come back to this Jira and reply.
We currently have a solution for this issue (or at least part of it) internally
and I'd like to share it once we have it working in production. Thanks!
was (Author: ethanli):
Thanks very much for your reply [~rmetzger]. The suggestions are helpful.
Sorry I haven't been able to come back to this Jira and reply.
We currently have a solution for this issue internally and I'd like to share it
once we have it working in production. Thanks!
> How to secure flink applications on yarn on multi-tenant environment
> --------------------------------------------------------------------
>
> Key: FLINK-17641
> URL: https://issues.apache.org/jira/browse/FLINK-17641
> Project: Flink
> Issue Type: Wish
> Components: Deployment / YARN
> Reporter: Ethan Li
> Priority: Major
>
> This is a question I wish to get some insights on.
> We are trying to support and secure flink on shared yarn cluster. Besides the
> security provided by yarn side (queueACL, kerberos), what I noticed is that
> flink CLI can still interact with the flink job as long as it knows the
> jobmanager rpc port/hostname and rest.port, which can be obtained easily with
> yarn command.
> Also on the UI side, on yarn cluster, users can visit flink job UI via yarn
> proxy using browser. As long as the user can authenticate and view yarn
> resourcemanager webpage, he/she can visit the flink UI without any problem.
> This basically means Flink UI is wide-open to corp internal users.
> On the internal connection side, I am aware of the support added in 1.10 to
> limit the mTLS connection by configuring
> security.ssl.internal.cert.fingerprint
> (https://ci.apache.org/projects/flink/flink-docs-stable/ops/security-ssl.html)
> This works but it is not very flexible. Users need to update the config if
> the cert changes before they submit a new job.
> I asked the similar question on the mailing list before. I am really
> interested in how other folks deal with this issue. Thanks.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
