[FLINK-9312] Perform mutual authentication during SSL handshakes

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.6.0
• Component/s: Runtime / Coordination
• Labels: pull-request-available
• Assignee: Stephan Ewen
• Reporter: Stephan Ewen
• Created: 07/May/18 19:55
• Updated: 02/Oct/19 17:43
• Resolved: 16/Jul/18 07:05

Description

Currently, the Flink processes encrypted connections via SSL:

• Data exchange TM - TM
• RPC JM - TM
• Blob Service JM - TM

However, the server side always accepts any client to build up the connection, meaning the connections are not strongly authenticated.

Activating SSL mutual authentication solves that - only processes that have the same certificate can connect.

Issue Links

• links to: GitHub Pull Request #5966

Sub-Tasks

• Enable mutual authentication for RPC (akka): Resolved
• Enable SSL mutual authentication for Netty / TaskManagers: Resolved