RBAC model

Role-based Access Control Model #

To be able to deploy the operator itself and Flink jobs, we define two separate Kubernetes roles. The former, called flink-operator role is used to manage the flinkdeployments, to create and manage the JobManager deployment for each Flink job and other resources like services. The latter, called the flink role is used by the JobManagers of the jobs to create and manage the TaskManagers and ConfigMaps for the job.

Flink Operator RBAC Model

These service accounts and roles can be created via the operator Helm chart. By default the flink-operator role is cluster scoped (created as a clusterrole) and thus allowing a single operator instance to be responsible for all Flink deployments (jobs) in a Kubernetes cluster regardless of the namespace they are deployed to (with the additional instruction below). Certain environments are more restrictive and only allow namespaced roles, so we also support this option via watchNamespaces.

The flink role is always namespaced, by default it is created in the namespace of the operator. When watchNamespaces is enabled it is created for all watched namespaces individually.

The steps described in the quick-start let users install Flink operator and run Flink jobs in the default namespace. To run Flink jobs in another namespace, users are responsible for creating a flink service account in that namespace. This is when users deploy cluster scoped Flink operator without using the --set watchNamespaces={namespaces} option and wish to create Flink jobs in other namespaces later.

For each additional namespace that runs the Flink jobs, users need to do the following:

  1. Switch to the namespace by running:
    kubectl config set-context --current --namespace=CHANGEIT
    
  2. Create the service account, role, and role binding in the namespace using the commands below:
    kubectl apply -f - <<EOF
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      labels:
        app.kubernetes.io/name: flink-kubernetes-operator
        app.kubernetes.io/version: 1.0.1
      name: flink
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      labels:
        app.kubernetes.io/name: flink-kubernetes-operator
        app.kubernetes.io/version: 1.0.1
      name: flink
    rules:
    - apiGroups:
      - ""
      resources:
      - pods
      - configmaps
      verbs:
      - '*'
    - apiGroups:
      - apps
      resources:
      - deployments
      verbs:
      - '*'
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      labels:
        app.kubernetes.io/name: flink-kubernetes-operator
        app.kubernetes.io/version: 1.0.1
      name: flink-role-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: flink
    subjects:
    - kind: ServiceAccount
      name: flink
    EOF
    
  3. Optionally create an example Flink job in the namespace. Run the command from the root of the cloned flink-kuberntes-operator repo:
    kubectl apply -f example/basic.yaml