[
https://issues.apache.org/jira/browse/FLINK-15911?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17305971#comment-17305971
]
Xintong Song commented on FLINK-15911:
--------------------------------------
I think it's a good practice to listen on as less interfaces as possible *only
if* we know which interface exactly should be used.
In your case, IIUC, the security concern comes from the fact that there are
multiple network interfaces on your Yarn NM machines, and not all of them are
safe. IMO, this is a flaw of Yarn cluster management. Applications running on
Yarn (i.e. Flink) should not understand which interface is safe and which is
not. These physical specifications are supposed to be transparent to the
applications.
I'm afraid binding to `taskmanager.host` is not an option.
* This configuration option represents the external address that other peers
should use to connect to the current peer. Depending on the network setups,
this address may not be resolvable locally.
* As the codes suggest, this configuration option may not alway be set. The
value can be `null`.
> Flink does not work over NAT
> ----------------------------
>
> Key: FLINK-15911
> URL: https://issues.apache.org/jira/browse/FLINK-15911
> Project: Flink
> Issue Type: Bug
> Components: Runtime / Coordination
> Affects Versions: 1.10.0
> Reporter: Till Rohrmann
> Assignee: Xintong Song
> Priority: Blocker
> Labels: pull-request-available, usability
> Fix For: 1.11.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Currently, it is not possible to run Flink over network address translation.
> The problem is that the Flink processes do not allow to specify separate bind
> and external ports. Moreover, the {{TaskManager}} tries to resolve the given
> {{taskmanager.host}} which might not be resolvable. This breaks NAT or docker
> setups where the external address is not resolvable from within the
> container/internal network.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
