fightBoxing opened a new pull request, #7392:
URL: https://github.com/apache/kyuubi/pull/7392
### _Why are the changes needed?_
Currently, Kyuubi supports IP deny list (`ip.deny.list`) to block specific
IPs from connecting. However, in some security-sensitive environments,
administrators need the opposite approach — only allowing specific trusted IPs
to connect (allowlist/whitelist pattern). This is a common security requirement
for production deployments.
This PR adds a new configuration
`kyuubi.server.limit.connections.ip.allowlist` that, when non-empty, only
permits connections from the listed IPs. All other IPs will be denied. When the
list is empty (default), no restriction is applied.
### _How was this patch tested?_
- Added 5 unit test cases in `SessionLimiterSuite`:
- test session limiter with ip allowlist
- test session limiter ip allowlist with multiple ips
- test session limiter empty ip allowlist allows all ips
- test session limiter ip deny list has higher priority than ip allowlist
- test refresh ip allowlist
### _Was this patch authored or co-authored using generative AI tooling?_
No
### Changes:
- Add `SERVER_LIMIT_CONNECTIONS_IP_ALLOWLIST` config in KyuubiConf
(`kyuubi.server.limit.connections.ip.allowlist`)
- Add `ipAllowlist` field in `SessionLimiterWithAccessControlListImpl`
- Add ip allowlist check in `SessionLimiter.increment()` (after deny list
check, so deny list takes higher priority)
- Add `getIpAllowlist`/`refreshIpAllowlist` in `KyuubiSessionManager`
- Add `refreshIpAllowlist()` in `KyuubiServer`
- Add REST API endpoint `POST /api/v1/admin/refresh/ip_allowlist`
### Priority Note:
When an IP is in both `ip.deny.list` and `ip.allowlist`, the **deny list
takes higher priority** (the connection will be denied).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
