[CDAP Operator] Add SSL and Authentication for JMX servers running for System Metrics Collection
Description
Release Notes
None
Attachments
1
Activity
Show:
Pinned fields
Click on the next to a field label to start pinning.
Details
Details
Assignee

Reporter

Components
Priority
Created January 28, 2022 at 2:25 PM
Updated January 28, 2022 at 2:25 PM
Presently JMX servers that are started for metrics collection using sidecar containers don’t have authentication or SSL encryption. They are bound to localhost (due to flag
-Dcom.sun.management.jmxremote.host=localhost
) and cannot be reached from an external network interface. Output of running netstat from pod with JMX server shows verifies that JMX Port (11022 in this case) is listening on localhost. Checked that telnet isn’t able to connect to JMX port from outside.There may still be a chance that local JMX server could be exploited if pod runs (malicious)user code.
We should add SSL + Authentication to prevent this possibility.
Ref: PR review comment