Pluggable Certificates
On this page
Users can use their own certificates to enable SSL for Flink internal/external communications, via the following steps
- Generate Certificates for VVP and Flink Jobs
- Provide deployment with custom ssl Flink Configuration
- Provide configuration for VVP installation with custom keystore
:::info[Important: Session Clusters Not Supported]
Note that session clusters are not supported in this configuration. The instructions provided are specifically designed for job clusters. Using these configurations with session clusters might lead to unexpected behavior or compatibility issues. Ensure that you are deploying job clusters to avoid any potential problems related to SSL and certificate management.
:::
Configuration
In order to begin using certificates for Flink internal and external communications, users will have to follow several configuration steps including generating keystores, Kubernetes environment preparation, SSL enablement, and finally deployment.
The commands in the following two sections generate a keystore for Ververica Platform vvp.keystore and a keystore for a Flink job flink-rest.keystore. If you want to use your own public/corporate CA signed certificate, please ask your security team to generate the two keystores by following the similar procedure.
The procedure below uses two Kubernetes namespaces:
vvp-namespace: the Kubernetes namespace where Ververica Platform runsjob-namespace: the Kubernetes namespace where Flink jobs run
Substitute them with the namespaces you use in your own Kubernetes cluster if necessary.
Generate Ververica Platform keystore
In order to genereate the keystore for Ververica Platform appmanager, use the following commands:
1keytool -genkeypair -alias rootca/v2 -dname "cn=ca.app-manager.v2" -validity 10000 -keyalg RSA -keysize 4096 -ext "bc=ca:true" -ext KeyUsage:critical=keyCertSign -keystore vvp-root.keystore -keypass key-store-pass -storepass key-store-pass
2
3keytool -exportcert -keystore vvp-root.keystore -alias rootca/v2 -storepass key-store-pass -file vvp-root.cer
4
5keytool -genkeypair -alias client -dname "cn=me.app-manager" -validity 10000 -keyalg RSA -keysize 4096 -keystore vvp-client.keystore -keypass key-store-pass -storepass key-store-pass
6
7keytool -exportcert -keystore vvp-client.keystore -alias client -storepass key-store-pass -file vvp-client.cer
8
9keytool -importkeystore -srckeystore vvp-root.keystore -srcalias rootca/v2 -srckeypass key-store-pass -srcstorepass key-store-pass -destalias rootca/v2 -destkeystore vvp.keystore -destkeypass key-store-pass -deststorepass key-store-pass -deststoretype PKCS12
10
11keytool -importkeystore -srckeystore vvp-client.keystore -srcalias client -srckeypass key-store-pass -srcstorepass key-store-pass -destalias client -destkeystore vvp.keystore -destkeypass key-store-pass -deststorepass key-store-pass -deststoretype PKCS12Generate Flink job keystore
To generate Flink job keystore, use the following commands:
1keytool -genkeypair -alias flink.rest -keystore flink-rest.keystore -dname "CN=*.job-namespace.svc" -ext "SAN=dns:*.job-namespace.svc.cluster.local" -storepass keystore_password -keyalg RSA -keysize 4096 -storetype PKCS12
2
3keytool -certreq -alias flink.rest -keystore flink-rest.keystore -storepass keystore_password -file rest.csr
4keytool -gencert -alias rootca/v2 -keystore vvp-root.keystore -storepass key-store-pass -ext "SAN=dns:*.job-namespace.svc" -infile rest.csr -outfile rest.cer
5cat rest.cer vvp-root.cer > chain.cer
6
7keytool -importcert -keystore flink-rest.keystore -storepass keystore_password -file vvp-client.cer -alias client -noprompt
8keytool -importcert -keystore flink-rest.keystore -storepass keystore_password -file chain.cer -alias flink.rest -nopromptKubernetes environment preparation
To prepare the Kubernetes environment for use, use the following command:
1kubectl --namespace=vvp-namespace create secret generic vvp-keystore --from-file=vvp.keystoreThe Ververica Platform configuration is provided by the values.yaml file.
1vvp:
2 appmanager:
3 ssl:
4 keystore: /vvp-keystore/vvp.keystore
5 keystore-password: key-store-pass
6 keystore-key-password: key-store-pass
7
8volumeMounts:
9 - name: vvp-keystore
10 mountPath: /vvp-keystore
11
12volumes:
13 - name: vvp-keystore
14 secret:
15 secretName: vvp-keystoreTo create Kubernetes secrets, use the following two commands:
1kubectl --namespace=job-namespace create secret generic flink-truststore --from-file=flink-rest.keystore
2kubectl --namespace=job-namespace create secret generic flink-keystore --from-file=flink-rest.keystoreEnable SSL for network communication
In setup the SSL network communication, enable SSL with the following command:
1spec:
2 template:
3 metadata:
4 annotations:
5 flink.security.ssl.enabled: trueDeployments
To deploy the flinkConfiguration, use the following:
1spec:
2 template:
3 spec:
4 flinkConfiguration:
5 security.ssl.rest.enabled: 'true'
6 security.ssl.rest.key-password: keystore_password
7 security.ssl.rest.keystore: /flink-keystore/flink-rest.keystore
8 security.ssl.rest.keystore-password: keystore_password
9 security.ssl.rest.truststore: /flink-truststore/flink-rest.keystore
10 security.ssl.rest.truststore-password: keystore_passwordFor the Kubernetes configuration, deploy with the following:
1spec:
2 template:
3 spec:
4 kubernetes:
5 jobManagerPodTemplate:
6 spec:
7 containers:
8 - name: flink-jobmanager
9 volumeMounts:
10 - mountPath: /flink-truststore
11 name: flink-truststore
12 - mountPath: /flink-keystore
13 name: flink-keystore
14 volumes:
15 - name: flink-truststore
16 secret:
17 secretName: flink-truststore
18 - name: flink-keystore
19 secret:
20 secretName: flink-keystore
21 taskManagerPodTemplate:
22 spec:
23 containers:
24 - name: flink-taskmanager
25 volumeMounts:
26 - mountPath: /flink-truststore
27 name: flink-truststore
28 - mountPath: /flink-keystore
29 name: flink-keystore
30 volumes:
31 - name: flink-truststore
32 secret:
33 secretName: flink-truststore
34 - name: flink-keystore
35 secret:
36 secretName: flink-keystore