Mailing-List: contact dev-help@flink.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@flink.apache.org
Message-ID: <BLU436-SMTP4224A3DA00D27AFE0A5C85D1490@phx.gbl>
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Subject: Re: [DISCUSS] Secure Flink clusters
From: "Wright, Eron" <ewright@live.com>
In-Reply-To: <BLU437-SMTP13B660C75DB421F96EC607D1480@phx.gbl>
Date: Wed, 18 May 2016 14:33:18 -0700
Content-Transfer-Encoding: quoted-printable
References: <BLU436-SMTP21700667B3FF77BDDA1F1F4D1720@phx.gbl> <CAGco--Z_NYnN_pMusq=XCDUn1ERij9vtLXE2310huUgCR29zuA@mail.gmail.com> <CAGr9p8As88vCJ0RJdC-Kg78WuYJJ2BaFhyLMPyC-sYMrx65uyQ@mail.gmail.com> <BLU437-SMTP13B660C75DB421F96EC607D1480@phx.gbl>
To: dev@flink.apache.org
archived-at: Wed, 18 May 2016 21:33:36 -0000

Update, the following issues were filed:

- [FLINK-3929] Support for Kerberos Authentication with Keytab =
Credential
- [FLINK-3930] Implement Service-Level Authorization
- [FLINK-3931] Implement Transport Encryption (SSL/TLS)
- [FLINK-3932] Implement State Backend Security

> On May 17, 2016, at 11:10 AM, Wright, Eron <ewright@live.com> wrote:
>=20
> Thanks to all who reviewed the document.    It appears we have a good =
plan and I'm filing JIRA issues accordingly.
>=20
> Robert, I'm in touch with Max, Stephan, and Stefano.    I=E2=80=99ll =
update the thread when we have a better sense of the timing.   The work =
will clearly span a couple of releases.
>=20
> Eron
>=20
>=20
>> On May 17, 2016, at 8:35 AM, Robert Metzger <rmetzger@apache.org> =
wrote:
>>=20
>> Hi Eron,
>>=20
>> thanks a lot for putting so much effort into the design document. =
You've
>> probably spend a lot of time to come up with it!
>> I have to admit that I'm not that familiar with the topic, so I =
probably
>> need to re-read it again to digest it completely.
>>=20
>> What are your plans for implementing the proposed changes? (time-wise =
and
>> people-wise?) I'm asking to get an idea of when we can expect the =
changes
>> in the master, in releases, ...
>>=20
>> I think Stefano Baghino also had some discussions about improving =
Flink's
>> security on the mailing list recently. Maybe you guys can sync your =
efforts
>> and collaborate on this.
>>=20
>> Regards,
>> Robert
>>=20
>>=20
>> On Fri, May 13, 2016 at 12:47 PM, Maximilian Michels <mxm@apache.org> =
wrote:
>>=20
>>> Hi Eron,
>>>=20
>>> Thank you for this comprehensive design document. Really great read.
>>> I've left some minor comments.
>>>=20
>>> +1 for breaking down the tasks into many JIRA issues; we have quite
>>> some ambitious plans now :) It would be great to get some more =
people
>>> from the community involved as well.
>>>=20
>>> Best,
>>> Max
>>>=20
>>> On Wed, May 11, 2016 at 9:09 AM, Wright, Eron <ewright@live.com> =
wrote:
>>>> Hello!
>>>>=20
>>>> There=E2=80=99s been a few discussions lately on how to improve the =
Kerberos
>>> support in Flink.  I=E2=80=99ve drafted a design document that lays =
out a plan to
>>> support keytab-based authentication for HDFS, Kafka, and ZooKeeper.  =
In
>>> addition, the plan contemplates secure, TLS-based communication =
between
>>> cluster components.
>>>>=20
>>>> The main goals are secure data access for Kerberized connectors and
>>> cluster authentication to prevent unauthorized access to cluster =
secrets.
>>>>=20
>>>> Here is the document:
>>>>=20
>>> =
https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8=
oPaAs/edit?usp=3Dsharing
>>>>=20
>>>> I anticipate filing a multitude of JIRAs following a design =
discussion.
>>> It is a big task and there will be opportunities for others in the
>>> community to help.
>>>>=20
>>>> Thanks,
>>>> Eron Wright
>>>> EMC
>>>=20
>=20