Details
-
Epic
-
Status: Resolved
-
Blocker
-
Resolution: Implemented
-
None
-
SSL
Description
Currently all the messages that flow through the Mesos cluster are unencrypted
making it possible for intruders to intercept and potentially control your task.
We plan to add encryption support by adding SSL/TLS support to libprocess, the
low-level communication library that Mesos uses for all network communication
between Mesos components.
As a first step, we should replace the hand-coded http code in libprocess with a
standard library, ensuring that any mesos custom code like routing remains.
Then, transition to https should be easier.
Road map to SSL
- Isolate libev dependencies to a manageable set of implementing files.
MESOS-1912Decouple libev from clock implementationMESOS-1914Decouple libev from connection handling (use io::poll() instead of individual watchers)MESOS-1952Abstract network logic into socket class: connect()MESOS-1954Abstract network logic into socket class: read()/write()MESOS-1953Abstract network logic into socket class: connection events (connected(), closed(), writable(), readable())- MESOS-2119 Add Socket tests
- (MESOS-XXXX Libev backed Socket)
- Provide alternative implementation with libevent.
MESOS-2106Enable libevent backed libprocess with configure flag.MESOS-2107Create libevent-backed clock implementationMESOS-2133Create libevent-backed poll implementation- MESOS-1911 Create libevent-backed socket implementation
- Enable SSL
MESOS-2108Add configure flag or environment variable to enable SSL/libevent SocketMESOS-2109Introduce socket factoryMESOS-1913Create libevent/SSL-backed Socket implementationMESOS-2085Add support encrypted and non-encrypted communication in parallel for cluster upgrade
Attachments
Issue Links
- blocks
-
MESOS-2727 0.23.0 Release
- Resolved
- relates to
-
MESOS-418 Add security and authentication support to Mesos (including integration with LDAP).
- Resolved
- supercedes
-
MESOS-1330 Introduce stream abstraction to libprocess
- Resolved