Flink SecurityContext 概览

在Flink中通过SecurityContext进行操作的权限验证，验证通过以后执行具体操作。接口中定义的一个方法如下：

<T> T runSecured(Callable<T> securedCallable) throws Exception;

 

Flink中在ClusterEntrypoint类中通过installSecurityContext进行安全上下文的组装，Flink默认是NoOpSecurityContext鉴权方式，不需要鉴权，直接进行对应的方法。

同时还支持HadoopModule、JaasModele、ZookeeperModule等方式的认证方式。

public static void install(SecurityConfiguration config) throws Exception {

        // install the security modules
        List<SecurityModule> modules = new ArrayList<>();
        try {
            for (SecurityModuleFactory moduleFactory : config.getSecurityModuleFactories()) {
                SecurityModule module = moduleFactory.createModule(config);
                // can be null if a SecurityModule is not supported in the current environment
                if (module != null) {
                    module.install();
                    modules.add(module);
                }
            }
        }
        catch (Exception ex) {
            throw new Exception("unable to establish the security context", ex);
        }
        installedModules = modules;

        // First check if we have Hadoop in the ClassPath. If not, we simply don't do anything.
        try {
            Class.forName(
                "org.apache.hadoop.security.UserGroupInformation",
                false,
                SecurityUtils.class.getClassLoader());

            // install a security context
            // use the Hadoop login user as the subject of the installed security context
            if (!(installedContext instanceof NoOpSecurityContext)) {
                LOG.warn("overriding previous security context");
            }
            UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
            installedContext = new HadoopSecurityContext(loginUser);
        } catch (ClassNotFoundException e) {
            LOG.info("Cannot install HadoopSecurityContext because Hadoop cannot be found in the Classpath.");
        } catch (LinkageError e) {
            LOG.error("Cannot install HadoopSecurityContext.", e);
        }
    }

第6行，getSecurityModuleFactories就是默认的

Arrays.asList(new HadoopModuleFactory(), new JaasModuleFactory(), new ZookeeperModuleFactory())

这三类Factory，在对应的Factory中生成与之想对应的Modele。

从21行开始，还是对hadoop的特殊操作，直接在环境变量中加载hadoop的安全验证组件UserGroupInformation，如果环境变量中存在，那么获取hadoop中的用户信息构造HadoopSecurityContext，并且更新installedContext。