Security in Flink

Desribes about the Security in Flink.

TLS/SSL

DEP Flink generates self-signed certificates and enables TLS/SSL automatically, .

The TLS introduces some known warnings. See Flink 2.0.0.0 - 2510 (DEP 10.0.0) Release Notes for more information.

For more information on how to apply your custom TLS/SSL configuration, see SSL Setup page of Apache Flink documentation.

Authentication

IMPORTANT
Apache Flink also recommends having external authentication proxy, see External / REST Connectivity page for more information.
Once the TLS handshake happens between a client and a Job Manager, no further client authentication happens in Flink. However, to secure the Flink cluster, do the following:

  1. Isolate the Flink deployment on network layer (for example, with firewall).

  2. Enable mutual TLS authentication and only allow trusted clients to connect.

Impersonation or Multi-tenancy

Impersonation or Multi-tenancy is not supported. The user is expected to run the Flink cluster job with the respective mapr ticket file.
NOTE
It is recommended to make a copy of the conf directory from the Flink distribution and modify the settings on a per-user basis. You can specify a different configuration directory location by defining the FLINK_CONF_DIR environment variable. See Configuration page for more information.