Cloudera Docs

Securing communication between NiFi clusters using the Default Node SSL Context Service

The Cloudera Flow Management Operator for Kubernetes automatically provisions a DefaultNodeSSLContextService controller service in the root process group of each NiFi cluster it manages. This controller service is an instance of StandardSSLContextService that references the node keystore and truststore generated by the operator, making TLS credentials available to data flows without requiring manual SSL configuration.

The operator creates the DefaultNodeSSLContextService on initial deployment and checks it on every subsequent reconciliation.

  • If the service is missing, the operator recreates it.
  • If the service is present, the operator validates its configuration.

The service is configured with the following values:

Table 1. Service configuration reference
Property Value
Service type StandardSSLContextService
Keystore path /opt/nifi/nifi-current/data/keystore.jks
Truststore path /opt/nifi/nifi-current/data/truststore.jks
Keystore and truststore password Retrieved from the <nifi-name>-keystorepassword Kubernetes Secret
Default keystore type JKS
TLS protocol TLS

You can reference the DefaultNodeSSLContextService in any processor that requires an SSL Context Service. For example, you can use it to secure communication between two NiFi clusters managed by the same operator instance, using an InvokeHTTP processor on the sending cluster and a ListenHTTP processor on the receiving cluster.

Ensure that:

  • Both NiFi clusters are managed by the same Cloudera Flow Management Operator for Kubernetes instance.
  • The node certificates for both clusters are signed by the same root certificate authority, establishing a shared chain of trust.
  • The Kubernetes service for the receiving cluster exposes the port used by the ListenHTTP processor.
  1. On the receiving cluster, add a ListenHTTP processor to the flow and configure the following properties.
    Listening Port

    Enter the port on which the processor listens for incoming requests.

    For example: 9999

    Base Path

    Enter the base path for the listener endpoint.

    For example: contentListener

    SSL Context Service

    Select DefaultNodeSSLContextService.

  2. On the sending cluster, add an InvokeHTTP processor to the flow and configure the following properties.
    HTTP URL
    Enter the internal Kubernetes Service URL of the receiving cluster, using the following format: 
    https://[***nifi-name***].[***namespace***].svc.cluster.local:[***port***]/[***basepath***]

    Replace [***nifi-name***], [***namespace***], [***port***], and [***basepath***] with the actual values for the receiving cluster.

    SSL Context Service

    Select DefaultNodeSSLContextService.

  3. Start both processors.
  4. Send a FlowFile through the InvokeHTTP processor and verify that the ListenHTTP processor on the receiving cluster receives the request.