Flink Forward Berlin 2018: Edward Alexander Rojas Clavijo - "Deploying a secured Flink cluster on Kubernetes"
•
1 like•706 views
One of the main sources of concerns when switching to the container paradigm is security. When dealing with big amounts of sensitive customer data it’s very important to be able to guarantee that the data is transported safely between the different components of the system. This talk will focus on how to setup a Flink cluster to run on a Kubernetes environment taking into account all security aspects to ensure secured communication between the nodes of the cluster, state backend and also for job submission, all taking advantage of Kubernetes tools.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Flink Forward Berlin 2018: Edward Alexander Rojas Clavijo - "Deploying a secured Flink cluster on Kubernetes"
Similar to Flink Forward Berlin 2018: Edward Alexander Rojas Clavijo - "Deploying a secured Flink cluster on Kubernetes" (20)
More from Flink Forward
More from Flink Forward (20)
Recently uploaded
Recently uploaded (20)
Flink Forward Berlin 2018: Edward Alexander Rojas Clavijo - "Deploying a secured Flink cluster on Kubernetes"
- 1. Deploying a secured Flink cluster on Kubernetes Edward Rojas Clavijo Software Engineer IBM France
- 2. Use case • Multiple sources of data => Kafka • Different storage targets • Multiple environments • Sensitive customer data => Secured • Highly available • Fault tolerant
- 3. Zookeeper Job Manager HA Task Manager Task Manager Task Manager Task Manager Task Manager Storage checkpoints / savepoints Flink Client Flink Client Flink Client Submit job Flink Architecture – use case 1.5.3
- 4. Flink on Kubernetes JM Service TM Flink Client TM TM JM JM Deployment TM Deployment Pods • Job Manager Deployment • Maintain 1 replica • Job Manager Service • Task Manager Deployment • Maintain n replicas • One Pod per Flink Job • Fixed amount of jobs • Endless stateful jobs • ConfigMap for flink conf
- 5. Flink SSL/TLS • Certificates generation • Dynamic IP • TM Dynamic hostnames JM Service TM Flink Client TM TM JM JM Deployment TM Deployment Pods
- 6. Flink SSL/TLS • Hostname validation • Task managers => Statefulset • Predictable hostnames • flink-tm-0.flink-tm-svc.<namespace>.svc.cluster.local • flink-tm-1.flink-tm-svc.<namespace>.svc.cluster.local JM Service TM Flink Client TM TM JM JM Deployment TM Statefulset Pods TM Service TM service • Wildcard certificate
- 7. Flink SSL/TLS • One single purpose certificate • Truststore and Keystore with only that certificate • Deactivate hostname validation Expose as secrets Mount on Pods base64 encoded
- 9. Sources and Sinks - Kerberos • Keytab file exposed as k8s secret • Configuration properties on ConfigMap => env vars • Realm, Principal, KDC • Dockerfile • COPY krb5.conf template – /etc/krb5.conf - set access rights • COPY core-site.xml template • Docker entrypoint: • Set krb5.conf • Flag for each service • Set flink conf properties • Set hadoop conf • Kafka consumer/producer • sasl.kerberos.service.name • security.protocol => SASL_PLAINTEXT
- 10. Sources and Sinks - SSL • Expose certificates as secrets => mount on pods • Dockerfile • Set access rights to $JAVA_HOME/lib/security/cacerts • Docker entrypoint: • Flag for each service • Import certificate into pods trustore keytool -importcert -file ${CERT_FILE} -alias ${certName} -keystore $JAVA_HOME/lib/security/cacerts - noprompt -storepass changeit
- 11. Sources and Sinks - SSL • Elasticsearch 6.x => REST • ElasticsearchSink – only Flink 1.6 => Custom ElasticsearchSink Flink 1.6 =>
- 12. Checkpoints / Savepoints • Persistent volume • NFS • Encryption in-flight and at-rest • Encrypt Job state => Custom State Serializer PV TM TM TM JM
- 13. What next? • Enforce with k8s security config • Use RBAC • Restrict access to kubectl • Use Network Policy • Pod security policy • Single job cluster -> Flink 1.6
- 14. Thanks for your attention! Edward Alexander Rojas Clavijo
Editor's Notes
- Generic
- StreamExecutionEnvironment registerTypeWithKryoSerializer