Flink web ui authentication using nginx

["Kumar Bolar, Harshith" <hk...@arity.com>]

Hi all,

I'm trying to add authentication to the web dashboard using `nginx`. Flink's `rest.port` is set to `8081`, connection to this port is disabled by firewall. I'm using `nginx` to listen to requests on port 8080 and redirect to port 8081 them with username/password authentication (Port 8080 is open).

This is what the server block looks like in `nginx.conf`.

server {
        listen       8080;
        server_name  localhost;
        include /etc/nginx/default.d/*.conf;
        location / {
        proxy_pass https://localhost:8081;
            auth_basic           "Administrator's Area";
            auth_basic_user_file /etc/apache2/.htpasswd;
        }
        error_page 404 /404.html;
            location = /40x.html {
        }
        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }


The port redirection is working fine but there are a couple of issues. When I go to the inactive job manager's UI, redirection to the active job manager is not happening. And when I try submitting a job from the UI, the upload gets stuck at "Saving". I’m using Flink 1.7.2

Has anyone successfully set up web UI authentication on Flink complete with HA mode? Any clues would be greatly appreciated.

Thanks,
Harshith

Re: Flink web ui authentication using nginx

[Till Rohrmann <tr...@apache.org>]

Hi Harshith,

I'm not an expert of how to setup nginx with authentication for Flink but I
could shed some light on the redirection problem. I assume that Flink's
redirection response might not be properly understood by nginx. The good
news is that with Flink 1.8, we no longer rely on client side redirection
responses but instead proxy internally. This means that the
RestServerEndpoint will contact the leading JobManager and retrieve the
required information without a redirect. Upgrading to Flink 1.8.2 might
solve this particular problem.

Cheers,
Till

On Thu, Sep 12, 2019 at 1:05 PM Kumar Bolar, Harshith <hk...@arity.com>
wrote:

> Hi all,
>
>
>
> I'm trying to add authentication to the web dashboard using `nginx`.
> Flink's `rest.port` is set to `8081`, connection to this port is disabled
> by firewall. I'm using `nginx` to listen to requests on port 8080 and
> redirect to port 8081 them with username/password authentication (Port 8080
> is open).
>
>
>
> This is what the server block looks like in `nginx.conf`.
>
>
>
> server {
>
>         listen       8080;
>
>         server_name  localhost;
>
>         include /etc/nginx/default.d/*.conf;
>
>         location / {
>
>         proxy_pass https://localhost:8081;
>
>             auth_basic           "Administrator's Area";
>
>             auth_basic_user_file /etc/apache2/.htpasswd;
>
>         }
>
>         error_page 404 /404.html;
>
>             location = /40x.html {
>
>         }
>
>         error_page 500 502 503 504 /50x.html;
>
>             location = /50x.html {
>
>         }
>
>     }
>
>
>
>
>
> The port redirection is working fine but there are a couple of issues.
> When I go to the inactive job manager's UI, redirection to the active job
> manager is not happening. And when I try submitting a job from the UI, the
> upload gets stuck at "Saving". I’m using Flink 1.7.2
>
>
>
> Has anyone successfully set up web UI authentication on Flink complete
> with HA mode? Any clues would be greatly appreciated.
>
>
>
> Thanks,
>
> Harshith
>