[
https://issues.apache.org/jira/browse/FLINK-40709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated FLINK-40709:
-----------------------------------
Labels: pull-request-available (was: )
> Kubernetes Operator: allowlist to exempt trusted hosts from jarURI
> restricted-host check
> ----------------------------------------------------------------------------------------
>
> Key: FLINK-40709
> URL: https://issues.apache.org/jira/browse/FLINK-40709
> Project: Flink
> Issue Type: Improvement
> Components: Kubernetes Operator
> Reporter: Purushottam Sinha
> Priority: Major
> Labels: pull-request-available
>
> h3. Problem
> kubernetes.operator.user.artifacts.disallow-restricted-hosts (default true)
> rejects any FlinkSessionJob jarURI resolving to a private/loopback/link-local
> address, which also blocks legitimate internal artifact stores (an in-cluster
> Service, an on-prem Artifactory on a private address). The only workaround
> today is disabling the check entirely, reopening SSRF exposure to everything
> -- including cloud metadata endpoints -- just to allow one trusted host.
> h3. Evidence
> * {{JarUriValidationUtils#validateJarURI}} enforces the restricted-host check
> unconditionally when enabled, with no exemption mechanism.
> * Related to FLINK-40402 / FLIP-613, which introduced the scheme allowlist
> and restricted-host check this proposes to extend.
> h3. Proposed fix
> * Add {{kubernetes.operator.user.artifacts.allowed-uri-prefixes}}
> (comma-separated jarURI prefixes, default empty) in
> {{KubernetesOperatorConfigOptions.java}}.
> * In {{JarUriValidationUtils#validateJarURI}}, skip only the restricted-host
> check when the jarURI starts with a configured prefix; the scheme allowlist
> is still enforced regardless.
> * Wire the new option through {{FlinkOperatorConfiguration}},
> {{HttpArtifactFetcher}} (re-checked on every redirect hop), and
> {{DefaultValidator}} (admission-time validation for FlinkSessionJob).
> h3. Acceptance
> * A FlinkSessionJob jarURI resolving to a restricted address is denied by the
> webhook by default, then accepted once its prefix is added to
> {{allowed-uri-prefixes}}.
> * Unit test coverage for both the exemption and the still-enforced scheme
> allowlist.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
