Re: [DISCUSS] Secure Flink clusters

2016-05-18 Thread Wright, Eron
Update, the following issues were filed: - [FLINK-3929] Support for Kerberos Authentication with Keytab Credential - [FLINK-3930] Implement Service-Level Authorization - [FLINK-3931] Implement Transport Encryption (SSL/TLS) - [FLINK-3932] Implement State Backend Security > On May 17, 2016, at 11:

Re: [DISCUSS] Secure Flink clusters

2016-05-17 Thread Henry Saputra
Eron, Could you please do also loop me in in the early discussions since we are interested on deploying Flink as standalone to access secure data via Kerberized access. I also was talking to Owen from HDFS at the Apache Big Data and there could be some work we can ask to be done in the Hadoop com

Re: [DISCUSS] Secure Flink clusters

2016-05-17 Thread Wright, Eron
Thanks to all who reviewed the document.It appears we have a good plan and I'm filing JIRA issues accordingly. Robert, I'm in touch with Max, Stephan, and Stefano.I’ll update the thread when we have a better sense of the timing. The work will clearly span a couple of releases. Eron

Re: [DISCUSS] Secure Flink clusters

2016-05-17 Thread Robert Metzger
Hi Eron, thanks a lot for putting so much effort into the design document. You've probably spend a lot of time to come up with it! I have to admit that I'm not that familiar with the topic, so I probably need to re-read it again to digest it completely. What are your plans for implementing the pr

Re: [DISCUSS] Secure Flink clusters

2016-05-13 Thread Maximilian Michels
Hi Eron, Thank you for this comprehensive design document. Really great read. I've left some minor comments. +1 for breaking down the tasks into many JIRA issues; we have quite some ambitious plans now :) It would be great to get some more people from the community involved as well. Best, Max O

[DISCUSS] Secure Flink clusters

2016-05-11 Thread Wright, Eron
Hello! There’s been a few discussions lately on how to improve the Kerberos support in Flink. I’ve drafted a design document that lays out a plan to support keytab-based authentication for HDFS, Kafka, and ZooKeeper. In addition, the plan contemplates secure, TLS-based communication between c