Apache Flink

Hi All , is there any difference in Role-based Access Control(RBAC) in flink native vs standalone deployment mode. does the the service account ("flink") created by flink native operator has a different level of access in native and standalone mode . thanks in advance

In Native mode the Flink service account needs to be able to create pods (create the TM instances)

in standalone mode it doesn’t need that specific permission because the operator itself creats the TMs

If the environment permits I recommend using the default Native mode.

Thanks <@U03HJRM8Q2Z> for clarification. Yes we are planning to use the Native operator deployment mode . But the only pending question which blocking us to move to native is the security concern which we found it in the flink operator documentation . what exactly is the security concern for native mode . can you please briefly describe

Security concern maybe a strong phrase. But basically it is related to what I said. In native mode the Flink service account has slightly wider permissions. It can create pods for instance

In standalone mode you cannot list/access other pods from the JM in the same way

Okay got it .. which means if there is a malicious code deployed , it can create multiple pods  without our permission. in satndalone since operator is creating the pods this wont happen

yea, but even in the standalone mode you need permissions like access configmaps etc

so the same applies but to similar extent

but in our prod envs this is not an issue, and we use native mode