[FLINK-3932] Implement State Backend Security

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Component/s: Runtime / Coordination
• Labels: security
• Assignee: Vijay Srinivasaraghavan
• Reporter: Eron Wright
• Created: 18/May/16 21:12
• Updated: 28/Feb/19 11:31
• Resolved: 28/Nov/16 17:28

Description

This issue is part of a series of improvements detailed in the Secure Data Access design doc.

Flink should protect its HA, checkpoint, and savepoint state against unauthorized access.

As described in the design doc, implement:

• ZooKeeper authentication w/ Kerberos
• ZooKeeper authorization (i.e. znode ACLs)
• Checkpoint/savepoint data protection

Issue Links

• is blocked by: FLINK-3929 Support for Kerberos Authentication with Keytab Credential
• requires: FLINK-4667 Yarn Session CLI not listening on correct ZK namespace when HA is enabled to use ZooKeeper backend
• links to: GitHub Pull Request #2589