Hi Aleksandr, We've started looking into this same issue internally. I think this would be a great addition, especially for shared compute pools.
+1 for the FLIP and also, let us know how we can help! Thanks, Ryan van Huuksloot Staff Engineer, Infrastructure | Streaming Platform [image: Shopify] <https://www.shopify.com/?utm_medium=salessignatures&utm_source=hs_email> On Fri, Jun 5, 2026 at 12:35 PM Aleksandr Savonin <[email protected]> wrote: > Hi everyone, > > Alan Sheinberg and I would like to start a discussion on FLIP-588: > Support per-job delegation tokens [1]. > Flink's delegation token framework is currently cluster-scoped, which > means a DelegationTokenProvider has no notion of an individual job. > This breaks when different jobs on the same cluster need to > authenticate as different identities to the same external service. > To resolve this, the FLIP adds per-job lifecycle hooks > (registerJob/unregisterJob/stop) as default methods on the > DelegationTokenProvider SPI, along with the runtime wiring to invoke > them on job start and stop. > This change is fully backward compatible (new methods are default > no-ops). It is worth mentioning that it widens the internal > registerJobMaster RPC to carry the job configuration. > > Looking forward to your feedback. > > [1] > https://cwiki.apache.org/confluence/display/FLINK/FLIP-588%3A+Support+per-job+delegation+tokens > > -- > Kind regards, > Aleksandr >
