Mailing-List: contact dev-help@flink.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@flink.apache.org
Message-ID: <BLU437-SMTP13B660C75DB421F96EC607D1480@phx.gbl>
From: "Wright, Eron" <ewright@live.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_29DA97B7-3421-48B5-B22A-FC2D0D7AF7C4"
MIME-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Subject: Re: [DISCUSS] Secure Flink clusters
Date: Tue, 17 May 2016 11:10:52 -0700
References: <BLU436-SMTP21700667B3FF77BDDA1F1F4D1720@phx.gbl> <CAGco--Z_NYnN_pMusq=XCDUn1ERij9vtLXE2310huUgCR29zuA@mail.gmail.com> <CAGr9p8As88vCJ0RJdC-Kg78WuYJJ2BaFhyLMPyC-sYMrx65uyQ@mail.gmail.com>
To: dev@flink.apache.org
In-Reply-To: <CAGr9p8As88vCJ0RJdC-Kg78WuYJJ2BaFhyLMPyC-sYMrx65uyQ@mail.gmail.com>
archived-at: Tue, 17 May 2016 18:11:07 -0000

--Apple-Mail=_29DA97B7-3421-48B5-B22A-FC2D0D7AF7C4
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Thanks to all who reviewed the document.    It appears we have a good =
plan and I'm filing JIRA issues accordingly.

Robert, I'm in touch with Max, Stephan, and Stefano.    I=E2=80=99ll =
update the thread when we have a better sense of the timing.   The work =
will clearly span a couple of releases.

Eron


> On May 17, 2016, at 8:35 AM, Robert Metzger <rmetzger@apache.org> =
wrote:
>=20
> Hi Eron,
>=20
> thanks a lot for putting so much effort into the design document. =
You've
> probably spend a lot of time to come up with it!
> I have to admit that I'm not that familiar with the topic, so I =
probably
> need to re-read it again to digest it completely.
>=20
> What are your plans for implementing the proposed changes? (time-wise =
and
> people-wise?) I'm asking to get an idea of when we can expect the =
changes
> in the master, in releases, ...
>=20
> I think Stefano Baghino also had some discussions about improving =
Flink's
> security on the mailing list recently. Maybe you guys can sync your =
efforts
> and collaborate on this.
>=20
> Regards,
> Robert
>=20
>=20
> On Fri, May 13, 2016 at 12:47 PM, Maximilian Michels <mxm@apache.org> =
wrote:
>=20
>> Hi Eron,
>>=20
>> Thank you for this comprehensive design document. Really great read.
>> I've left some minor comments.
>>=20
>> +1 for breaking down the tasks into many JIRA issues; we have quite
>> some ambitious plans now :) It would be great to get some more people
>> from the community involved as well.
>>=20
>> Best,
>> Max
>>=20
>> On Wed, May 11, 2016 at 9:09 AM, Wright, Eron <ewright@live.com> =
wrote:
>>> Hello!
>>>=20
>>> There=E2=80=99s been a few discussions lately on how to improve the =
Kerberos
>> support in Flink.  I=E2=80=99ve drafted a design document that lays =
out a plan to
>> support keytab-based authentication for HDFS, Kafka, and ZooKeeper.  =
In
>> addition, the plan contemplates secure, TLS-based communication =
between
>> cluster components.
>>>=20
>>> The main goals are secure data access for Kerberized connectors and
>> cluster authentication to prevent unauthorized access to cluster =
secrets.
>>>=20
>>> Here is the document:
>>>=20
>> =
https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8=
oPaAs/edit?usp=3Dsharing
>>>=20
>>> I anticipate filing a multitude of JIRAs following a design =
discussion.
>>  It is a big task and there will be opportunities for others in the
>> community to help.
>>>=20
>>> Thanks,
>>> Eron Wright
>>> EMC
>>=20


--Apple-Mail=_29DA97B7-3421-48B5-B22A-FC2D0D7AF7C4--