[
https://issues.apache.org/jira/browse/FLINK-3932?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15545908#comment-15545908
]
ASF GitHub Bot commented on FLINK-3932:
---------------------------------------
GitHub user vijikarthi opened a pull request:
https://github.com/apache/flink/pull/2589
FLINK-3932 State Backend Security
This PR addresses ZK authorization (ACLs) requirement of FLINK-3932 and its
dependency FLINK-4667 (Yarn session CLI not using correct ZK namespace in
secure environment).
No code change has been done for "checkpoint/savepoint data protection"
since the default implementation limits the access to user/groups. However, the
root directory for both checkpoint and savepoint should be configured to a
sub-directory under the "user home" directory with permissions 700 (mainly for
local file system since the default umask grants both the user and the group RW
access). For HDFS, since the user home directory is not accessible by any other
user (except superuser), we don't need to set any additional permissions for
the state backend directories.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/vijikarthi/flink feature-FLINK-3932
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/flink/pull/2589.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #2589
----
commit da5285ac24e2e9fcb8ac493a028aaa3599e82ec3
Author: Vijay Srinivasaraghavan <[email protected]>
Date: 2016-09-22T17:10:01Z
FLINK-3932 Added ZK ACL configuration for secure cluster setup
commit 9b9a9304a6d7262c5a56b1871f21fb3fa32b7ce7
Author: Vijay Srinivasaraghavan <[email protected]>
Date: 2016-09-23T17:23:19Z
FLINK-4667 Fix for using correct ZK namespace in Yarn deployment
----
> Implement State Backend Security
> --------------------------------
>
> Key: FLINK-3932
> URL: https://issues.apache.org/jira/browse/FLINK-3932
> Project: Flink
> Issue Type: New Feature
> Reporter: Eron Wright
> Assignee: Vijay Srinivasaraghavan
> Labels: security
> Original Estimate: 336h
> Remaining Estimate: 336h
>
> _This issue is part of a series of improvements detailed in the [Secure Data
> Access|https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8oPaAs/edit?usp=sharing]
> design doc._
> Flink should protect its HA, checkpoint, and savepoint state against
> unauthorized access.
> As described in the design doc, implement:
> - ZooKeeper authentication w/ Kerberos
> - ZooKeeper authorization (i.e. znode ACLs)
> - Checkpoint/savepoint data protection
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
