You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@flink.apache.org by rm...@apache.org on 2024/12/17 12:53:39 UTC
(flink) branch master updated: [FLINK-36889] Mention locking down a Flink cluster in the 'Production Readiness Checklist' (#25793)
This is an automated email from the ASF dual-hosted git repository.
rmetzger pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new 473a3e8a7b3 [FLINK-36889] Mention locking down a Flink cluster in the 'Production Readiness Checklist' (#25793)
473a3e8a7b3 is described below
commit 473a3e8a7b36ab3c4c9422fdc7da5dae60451f13
Author: Samrat <de...@gmail.com>
AuthorDate: Tue Dec 17 18:23:27 2024 +0530
[FLINK-36889] Mention locking down a Flink cluster in the 'Production Readiness Checklist' (#25793)
---
docs/content.zh/docs/ops/production_ready.md | 8 ++++++++
docs/content/docs/ops/production_ready.md | 11 ++++++++++-
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/docs/content.zh/docs/ops/production_ready.md b/docs/content.zh/docs/ops/production_ready.md
index e6ebec933ed..bb07d506bb9 100644
--- a/docs/content.zh/docs/ops/production_ready.md
+++ b/docs/content.zh/docs/ops/production_ready.md
@@ -81,5 +81,13 @@ It is a single point of failure within the cluster, and if it crashes, no new jo
Configuring [High Availability]({{< ref "docs/deployment/ha/overview" >}}), in conjunction with Apache Zookeeper or Flinks Kubernetes based service, allows for a swift recovery and is highly recommended for production setups.
+### Secure Flink Cluster Access
+
+Flink is intentionally designed to support remote code execution.
+To mitigate risks of malicious code execution, ensure that Flink clusters are properly secured.
+Avoid exposing clusters directly to the public internet.
+Instead, restrict access via company intranet or secure clusters with TLS, authentication, role-based access control (RBAC) etc.
+
+For more details, see the [Flink Security FAQ](https://flink.apache.org/what-is-flink/security/#during-a-security-analysis-of-flink-i-noticed-that-flink-allows-for-remote-code-execution-is-this-an-issue).
{{< top >}}
diff --git a/docs/content/docs/ops/production_ready.md b/docs/content/docs/ops/production_ready.md
index eaac1dc73f2..c20cf6a5aed 100644
--- a/docs/content/docs/ops/production_ready.md
+++ b/docs/content/docs/ops/production_ready.md
@@ -81,4 +81,13 @@ It is a single point of failure within the cluster, and if it crashes, no new jo
Configuring [High Availability]({{< ref "docs/deployment/ha/overview" >}}), in conjunction with Apache Zookeeper or Flinks Kubernetes based service, allows for a swift recovery and is highly recommended for production setups.
-{{< top >}}
\ No newline at end of file
+### Secure Flink Cluster Access
+
+Flink is intentionally designed to support remote code execution.
+To mitigate risks of malicious code execution, ensure that Flink clusters are properly secured.
+Avoid exposing clusters directly to the public internet.
+Instead, restrict access via company intranet or secure clusters with TLS, authentication, role-based access control (RBAC) etc.
+
+For more details, see the [Flink Security FAQ](https://flink.apache.org/what-is-flink/security/#during-a-security-analysis-of-flink-i-noticed-that-flink-allows-for-remote-code-execution-is-this-an-issue).
+
+{{< top >}}