is there an easy way to disable the pinot UI? I’m taking a look at this currently https://docs.pinot.apache.org/operators/tutorials/authentication-authorization-and-acls but wondering if there’s anything on just disabling UI for everyone without impacting anything else. wondering what is the setup that people usually do with their cluster so that people cannot mess with your tables and stuff.

Adding to it - How do we disable swagger? FYI @abhinav wagle

thank you i was wondering that too ^

Please check to see if this helps :https://github.com/apache/pinot/pull/8314

This is great! What about disabling swagger?

That should be taken care by controller?

I didn't understand.

Swagger is just a UI on top of controller apis.

I have a feeling this is something trivial that is not adding up in my brain.

yeah, but the reason you don’t want the UI is to prevent the apis right?

hmm, that's fair.

hey @Mayank this is setup for 0.11.0 do you have any clue when can we have some documentation as to how to implement it?

@Xiaoman Dong ^^

@Luis Fernandez There are two fronts of access control, and potentially 3 solutions: 1. disable swagger UIs completely. Right now there are two flags for disabling server and broker UIs (PR). Someone will have to contribute to controller part, you can contribute to that; 2. Access control by utilizing the Access Controls. This one is a beast to implement properly and securely; it involves setting up the control factories properly, @Mayank has linked to the PR, you can start by adding

controller.admin.access.control.factory.class=org.apache.pinot.controller.api.access.ZkBasicAuthAccessControlFactory

but there are other properties, you will have to read through the code and read the doc 3. Some advanced user like @David Yang from Stripe has done ngix proxy rules to block some specific endpoints, it is something in a lower stack of networking to control which access you can give to the incoming traffic

thanks for the thorough response, I was asking more about the 2nd point Access Control with the new

ZkBasicAuthAccessControlFactory

I was trying to implement yesterday but def just going off the current guide + adding that config didn’t suffice, I guess that I will have to go thru the code as well to implement properly, in any case I may have question around that but will try to do so and document how to do it, I tried to do it in my local but I started getting 403s when doing the AuthQuickStar example with that new Access Control factory