[CDAP Operator] Add SSL and Authentication for JMX servers running for System Metrics Collection

Description

Presently JMX servers that are started for metrics collection using sidecar containers don’t have authentication or SSL encryption. They are bound to localhost (due to flag -Dcom.sun.management.jmxremote.host=localhost) and cannot be reached from an external network interface. Output of running netstat from pod with JMX server shows verifies that JMX Port (11022 in this case) is listening on localhost. Checked that telnet isn’t able to connect to JMX port from outside.

There may still be a chance that local JMX server could be exploited if pod runs (malicious)user code.

There's a minor concern in the future of the JMX server allowing for local sandbox escapes (for example, if we implement a Java sandbox around user code within the primary user code container, then malicious code could leverage this to escape from that sandbox).

We should add SSL + Authentication to prevent this possibility.

Ref: PR review comment

Release Notes

None

Attachments

1

Activity

Show:
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Components

Priority

Created January 28, 2022 at 2:25 PM
Updated January 28, 2022 at 2:25 PM