Now create keystores for each node with certificates signed by the above CA. Let node1.company.org and node2.company.org be the hostnames with IPs 192.168.1.1 and 192.168.1.2 respectively
Configure each node in the standalone cluster to pick up the keystore and truststore files present in the local file system.
### Example: 2 node cluster
* Generate 2 keystores, one for each node, and copy them to the filesystem on the respective node. Also copy the pulic key of the CA (which was used to sign the certificates in the keystore) as a Java truststore on both the nodes
* Configure conf/flink-conf.yaml to pick up these files
...
...
@@ -118,10 +120,11 @@ Now you can start the YARN session from the CLI like you would normally do.
### 2. Use YARN cli to deploy the keystores and truststore
We can use the YARN client's ship files option (-yt) to distribute the keystores and truststore. Since the same keystore will be deployed at all nodes, we need to ensure a single certificate in the keystore can be served for all nodes. This can be done by either using the Subject Alternative Name(SAN) extension in the certificate and setting it to cover all nodes (hostname and ip addresses) in the cluster or by using wildcard subdomain names (if the cluster is setup accordingly).
**Example**
#### Example
* Supply the following parameters to the keytool command when generating the keystore: -ext SAN=dns:node1.company.org,ip:192.168.1.1,dns:node2.company.org,ip:192.168.1.2
* Copy the keystore and the CA's truststore into a local directory (at the cli's working directory), say deploy-keys/
* Update the configuration to pick up the files from a relative path