[FLINK-39118] Add documentation for Native s3 FileSystem #27841
+237
−58
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -64,94 +64,267 @@ env.configure(config); | |
|
|
||
| Note that these examples are *not* exhaustive and you can use S3 in other places as well, including your [high availability setup]({{< ref "docs/deployment/ha/overview" >}}) or the [EmbeddedRocksDBStateBackend]({{< ref "docs/ops/state/state_backends" >}}#the-rocksdbstatebackend); everywhere that Flink expects a FileSystem URI (unless otherwise stated). | ||
|
|
||
| ## S3 FileSystem Implementations | ||
|
|
||
| Flink provides three independent S3 filesystem implementations, each with different trade-offs: | ||
|
|
||
| - **Native S3 FileSystem** (`flink-s3-fs-native`): Built directly on AWS SDK v2 with async I/O and parallel transfers, this implementation supports both checkpointing and the FileSystem sink. [Benchmarks](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=406620396) show ~2x higher checkpoint throughput (~200 MB/s vs ~90 MB/s) compared to the Presto implementation at state sizes up to 15 GB. **Experimental** in Flink 2.3; the API and behavior may change in future releases. | ||
| - **Presto S3 FileSystem** (`flink-s3-fs-presto`): Based on Presto project code, recommended for checkpointing. | ||
| - **Hadoop S3 FileSystem** (`flink-s3-fs-hadoop`): Based on Hadoop project code, has FileSystem sink support. | ||
|
|
||
| All three are self-contained with no dependency footprint, so there is no need to add Hadoop to the classpath to use them. | ||
|
|
||
| ## Common Configuration | ||
|
|
||
| ### Configure Access Credentials | ||
|
|
||
| After setting up the S3 FileSystem implementation, you need to make sure that Flink is allowed to access your S3 buckets. | ||
|
|
||
| #### Identity and Access Management (IAM) (Recommended) | ||
|
|
||
| The recommended way of setting up credentials on AWS is via [Identity and Access Management (IAM)](http://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html). You can use IAM features to securely give Flink instances the credentials that they need to access S3 buckets. Details about how to do this are beyond the scope of this documentation. Please refer to the AWS user guide. What you are looking for are [IAM Roles](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). | ||
|
|
||
| If you set this up correctly, you can manage access to S3 within AWS and don't need to distribute any access keys to Flink. | ||
|
|
||
| #### Access Keys (Discouraged) | ||
|
|
||
| Access to S3 can be granted via your **access and secret key pair**. Please note that this is discouraged since the [introduction of IAM roles](https://blogs.aws.amazon.com/security/post/Tx1XG3FX6VMU6O5/A-safer-way-to-distribute-AWS-credentials-to-EC2). | ||
|
|
||
| You need to configure both `s3.access-key` and `s3.secret-key` in Flink's [configuration file]({{< ref "docs/deployment/config#flink-configuration-file" >}}): | ||
|
|
||
| ```yaml | ||
| s3.access-key: your-access-key | ||
|
Contributor
There was a problem hiding this comment. Should we mention bucket level configuration overrides for all these? |
||
| s3.secret-key: your-secret-key | ||
| ``` | ||
|
|
||
| You can limit this configuration to JobManagers by using [delegation tokens]({{< ref "docs/deployment/security/security-delegation-token" >}}): | ||
|
|
||
| ```yaml | ||
| # For Native S3 or Hadoop implementations | ||
| fs.s3.aws.credentials.provider: org.apache.flink.fs.s3.common.token.DynamicTemporaryAWSCredentialsProvider | ||
|
Contributor
There was a problem hiding this comment. Dosen't Native FS have its own: https://github.com/apache/flink/blob/master/flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/token/DynamicTemporaryAWSCredentialsProvider.java? Also isn't it included in the credentials chain automatically? |
||
| # For Presto implementation | ||
| presto.s3.credentials-provider: org.apache.flink.fs.s3.common.token.DynamicTemporaryAWSCredentialsProvider | ||
| ``` | ||
|
|
||
| ### Configure Non-S3 Endpoint | ||
|
|
||
| The S3 filesystems also support using S3 compliant object stores. | ||
| To do so, configure your endpoint in [Flink configuration file]({{< ref "docs/deployment/config#flink-configuration-file" >}}): | ||
|
|
||
| ```yaml | ||
| s3.endpoint: your-endpoint-hostname | ||
| ``` | ||
|
|
||
| ### Configure Path Style Access | ||
|
|
||
Samrat002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| Some S3 compliant object stores might not have virtual host style addressing enabled by default. In such cases, you will have to provide the property to enable path style access in [Flink configuration file]({{< ref "docs/deployment/config#flink-configuration-file" >}}): | ||
|
|
||
| ```yaml | ||
| s3.path-style-access: true | ||
|
Contributor
There was a problem hiding this comment. Will we have any backwards compatibilty problem with config property name being changed? |
||
| ``` | ||
|
|
||
| ## S3 FileSystem Implementations | ||
|
Contributor
There was a problem hiding this comment. This heading is repeated twice at the same level, can it break ToC links? |
||
|
|
||
| ### Native S3 FileSystem | ||
|
|
||
| {{< hint warning >}} | ||
| **Experimental**: The Native S3 FileSystem implementation is experimental in Flink 2.3. While functionally complete, it should not yet be used in production environments. Please use Presto or Hadoop implementations for production deployments. | ||
|
Contributor
There was a problem hiding this comment. "it should not yet be used in production environments" Maybe too strong statement, it should also explain "why" you should be cautious using it in prod. |
||
| {{< /hint >}} | ||
|
|
||
| The Native S3 FileSystem is a pure-Java implementation built on the AWS SDK v2. It is registered under the schemes *s3://* and *s3a://*. It requires no additional dependencies and provides a drop-in replacement for the Presto and Hadoop implementations. | ||
|
|
||
| #### Setup | ||
|
|
||
| To use the Native S3 FileSystem, copy the JAR file from the `opt` directory to the `plugins` directory: | ||
|
|
||
| ```bash | ||
| mkdir -p ./plugins/s3-fs-native | ||
| cp ./opt/flink-s3-fs-native-{{< version >}}.jar ./plugins/s3-fs-native/ | ||
| ``` | ||
|
|
||
| #### Features | ||
|
|
||
| - **No external dependencies**: Built on AWS SDK v2 with minimal footprint | ||
| - **Drop-in replacement**: Compatible with the same S3 URI schemes (`s3://`) | ||
| - **Encryption support**: Server-side encryption (SSE) and KMS encryption | ||
|
Contributor
There was a problem hiding this comment. This "and" reads confusing. If we are talking about SSE-KMS it is server side |
||
| - **Assume role**: Cross-account access via IAM role assumption | ||
| - **Entropy injection**: Optimize S3 scalability through random key prefixes | ||
| - **Bulk copy**: Efficient multi-part copy operations via S3TransferManager | ||
|
|
||
| #### Configuration | ||
|
|
||
| The Native S3 FileSystem uses the following configuration options: | ||
|
|
||
| ```yaml | ||
| # AWS credentials (if using static credentials) | ||
| s3.access-key: your-access-key | ||
| s3.secret-key: your-secret-key | ||
|
|
||
| # AWS region (optional; auto-detected if not specified) | ||
| s3.region: us-east-1 | ||
|
|
||
| # Custom S3 endpoint for S3-compatible storage | ||
| s3.endpoint: your-endpoint-hostname | ||
|
|
||
| # Path style access for S3-compatible storage | ||
| s3.path-style-access: true | ||
|
|
||
| # Server-side encryption | ||
| s3.sse.type: sse-s3 # or sse-kms, aws:kms, AES256, none (default) | ||
| s3.sse.kms.key-id: arn:aws:kms:region:account:key/id # For SSE-KMS | ||
|
|
||
| # IAM role assumption for cross-account access | ||
| s3.assume-role.arn: arn:aws:iam::account:role/RoleName | ||
| s3.assume-role.external-id: external-id-if-required | ||
| s3.assume-role.session-name: flink-s3-session | ||
| s3.assume-role.session-duration: 3600 | ||
|
|
||
| # Performance tuning | ||
| s3.upload.min.part.size: 5242880 # 5MB default | ||
| s3.upload.max.concurrent.uploads: 4 # Based on CPU cores | ||
| s3.read.buffer.size: 262144 # 256KB default | ||
| s3.async.enabled: true # Enable async operations | ||
| s3.bulk-copy.enabled: true # Enable bulk copy | ||
| s3.bulk-copy.max-concurrent: 16 # Max concurrent copy ops | ||
|
|
||
| # Entropy injection for scalability | ||
| s3.entropy.key: _entropy_ | ||
| s3.entropy.length: 4 | ||
|
|
||
| # Retry configuration | ||
| s3.retry.max-num-retries: 3 | ||
|
|
||
| # Credentials provider | ||
| fs.s3.aws.credentials.provider: software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider | ||
|
Contributor
There was a problem hiding this comment. The default is Which may be a bit confusing this way. Should we have it explicitly in the config if this is our intention? |
||
| ``` | ||
|
|
||
| See the [AWS SDK v2 documentation](https://docs.aws.amazon.com/sdk-for-java/) for additional configuration details. | ||
|
|
||
| --- | ||
|
|
||
| ### Presto S3 FileSystem | ||
|
|
||
| {{< hint info >}} | ||
| You don't have to configure this manually if you are running [Flink on EMR](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-flink.html). | ||
| {{< /hint >}} | ||
|
|
||
| The Presto S3 FileSystem is based on code from the [Presto project](https://prestodb.io/). It is registered under the schemes *s3://* and *s3p://*. | ||
|
|
||
| #### Features | ||
|
|
||
| - **Recommended for checkpointing**: The Presto implementation is the recommended file system for checkpointing to S3 | ||
| - **Self-contained**: No Hadoop dependency required | ||
| - **Production-ready**: Stable and widely used | ||
|
|
||
| #### Setup | ||
|
|
||
| To use the Presto S3 FileSystem, copy the JAR file from the `opt` directory to the `plugins` directory: | ||
|
|
||
| ```bash | ||
| mkdir -p ./plugins/s3-fs-presto | ||
| cp ./opt/flink-s3-fs-presto-{{< version >}}.jar ./plugins/s3-fs-presto/ | ||
| ``` | ||
|
|
||
| #### Configuration | ||
|
|
||
| Configure it using [the same configuration keys as the Presto file system](https://prestodb.io/docs/0.272/connector/hive.html#amazon-s3-configuration), by adding the configurations to your [Flink configuration file]({{< ref "docs/deployment/config#flink-configuration-file" >}}): | ||
|
|
||
| ```yaml | ||
| # AWS credentials | ||
| s3.access-key: your-access-key | ||
| s3.secret-key: your-secret-key | ||
|
|
||
| # Custom endpoint | ||
| s3.endpoint: your-endpoint-hostname | ||
|
|
||
| # Path style access | ||
| s3.path-style-access: true | ||
|
|
||
| # Credentials provider | ||
| presto.s3.credentials-provider: org.apache.flink.fs.s3.common.token.DynamicTemporaryAWSCredentialsProvider | ||
| ``` | ||
|
|
||
| Refer to the [Presto documentation](https://prestodb.io/docs/0.272/connector/hive.html#amazon-s3-configuration) for all available configuration options. | ||
|
|
||
| --- | ||
|
|
||
| ### Hadoop S3 FileSystem | ||
|
|
||
| The Hadoop S3 FileSystem is based on code from the [Hadoop Project](https://hadoop.apache.org/). It is registered under the schemes *s3://* and *s3a://*. | ||
|
|
||
| #### Features | ||
|
|
||
| - **FileSystem sink support**: The only S3 implementation with support for the [FileSystem sink]({{< ref "docs/connectors/datastream/filesystem" >}}) | ||
|
Contributor
There was a problem hiding this comment. I thought FS sink is supported for Native as we have RecoverableWriter implementation, is it a miss or do we need more changes for FS sink support? |
||
| - **Self-contained**: No additional Hadoop installation required | ||
| - **Mature implementation**: Long-established code from the Hadoop ecosystem | ||
|
|
||
| #### Setup | ||
|
|
||
| To use the Hadoop S3 FileSystem, copy the JAR file from the `opt` directory to the `plugins` directory: | ||
|
|
||
| ```bash | ||
| mkdir -p ./plugins/s3-fs-hadoop | ||
| cp ./opt/flink-s3-fs-hadoop-{{< version >}}.jar ./plugins/s3-fs-hadoop/ | ||
| ``` | ||
|
|
||
| #### Configuration | ||
|
|
||
| Configure it using [Hadoop's s3a configuration keys](https://hadoop.apache.org/docs/stable/hadoop-aws/tools/hadoop-aws/index.html#S3A) by adding the configurations to your [Flink configuration file]({{< ref "docs/deployment/config#flink-configuration-file" >}}): | ||
|
|
||
| ```yaml | ||
| # AWS credentials | ||
| s3.access-key: your-access-key | ||
| s3.secret-key: your-secret-key | ||
|
|
||
| # Custom endpoint | ||
| s3.endpoint: your-endpoint-hostname | ||
|
|
||
| # Path style access | ||
| s3.path-style-access: true | ||
|
|
||
| # Connection settings | ||
| s3.connection.maximum: 10 | ||
|
|
||
| # Credentials provider | ||
| fs.s3a.aws.credentials.provider: org.apache.flink.fs.s3.common.token.DynamicTemporaryAWSCredentialsProvider | ||
| ``` | ||
|
|
||
| Hadoop configuration keys are automatically translated. For example, `fs.s3a.connection.maximum` becomes `s3.connection.maximum`. Refer to the [Hadoop S3A documentation](https://hadoop.apache.org/docs/stable/hadoop-aws/tools/hadoop-aws/index.html#S3A) for all available options. | ||
|
|
||
| --- | ||
|
|
||
| ## Using Multiple S3 Implementations | ||
|
|
||
| All three S3 implementations register as handlers for the *s3://* scheme. Additionally, each implementation supports alternative schemes: | ||
|
|
||
| | Implementation | Schemes | | ||
| |---------------|---------| | ||
| | Native S3 | *s3://*, *s3a://* | | ||
| | Presto | *s3://*, *s3p://* | | ||
| | Hadoop | *s3://*, *s3a://* | | ||
|
|
||
| Only one implementation can handle a given scheme at a time. The Native S3 implementation has the lowest priority, so when another implementation is present, it will take precedence for the *s3://* scheme. | ||
|
|
||
|
|
||
| You can use multiple S3 implementations simultaneously by leveraging their different URI schemes. For example, if a job uses the [FileSystem]({{< ref "docs/connectors/datastream/filesystem" >}}) sink (Hadoop-only) but Presto for checkpointing: | ||
|
|
||
| - Use *s3a://* scheme for the sink (Hadoop) | ||
| - Use *s3p://* scheme for checkpointing (Presto) | ||
Samrat002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| {{< hint info >}} | ||
| The Native S3 implementation does not introduce a new URI scheme. It supports the existing *s3://* and *s3a://* schemes. Since both the Native S3 and Hadoop implementations handle the same schemes, only one can be active at a time. To use the Native S3 implementation, ensure only the Native S3 plugin JAR is in the `plugins` directory. | ||
|
Contributor
There was a problem hiding this comment. That contradicts supported logic that allow to place both jars and select correct FS based on configurable priority |
||
|
|
||
|
|
||
|
|
||
| **Caution** : Do not load `flink-s3-fs-native` and `flink-s3-fs-hadoop` plugins simultaneously. | ||
|
Contributor
There was a problem hiding this comment. Why? Or what exactly is a concern here? FS won't load both of them for the same schema, but what is wrong in principle with using Native for checkpointing and Hadoop for Sink (just as an example)? |
||
| {{< /hint >}} | ||
|
|
||
| --- | ||
|
|
||
| ## Advanced Features | ||
|
|
||
| ### Entropy Injection | ||
|
|
||
| All S3 file systems support entropy injection, a technique to improve the scalability of AWS S3 buckets through adding random characters near the beginning of the key. | ||
|
|
||
| If entropy injection is activated, a configured substring in the path is replaced with random characters. For example, path | ||
| `s3://my-bucket/_entropy_/checkpoints/dashboard-job/` would be replaced by something like `s3://my-bucket/gf36ikvg/checkpoints/dashboard-job/`. | ||
|
|
@@ -175,7 +348,9 @@ The `s3.entropy.key` defines the string in paths that is replaced by the random | |
| If a file system operation does not pass the *"inject entropy"* write option, the entropy key substring is simply removed. | ||
| The `s3.entropy.length` defines the number of random alphanumeric characters used for entropy. | ||
|
|
||
| ### s5cmd | ||
|
|
||
| **Supported by**: Presto S3 FileSystem, Hadoop S3 FileSystem | ||
|
|
||
| Both `flink-s3-fs-hadoop` and `flink-s3-fs-presto` can be configured to use the [s5cmd tool](https://github.com/peak/s5cmd) for faster file upload and download. | ||
| [Benchmark results](https://cwiki.apache.org/confluence/display/FLINK/FLIP-444%3A+Native+file+copy+support) are showing that `s5cmd` can be over 2 times more CPU efficient. | ||
|
|
@@ -187,7 +362,10 @@ Secondly, the path to the `s5cmd` has to be configured via: | |
| s3.s5cmd.path: /path/to/the/s5cmd | ||
| ``` | ||
|
|
||
| #### Configuration | ||
|
|
||
| The remaining configuration options (with their default value listed below) are: | ||
|
|
||
| ```yaml | ||
| # Extra arguments that will be passed directly to the s5cmd call. Please refer to the s5cmd's official documentation. | ||
| s3.s5cmd.args: -r 0 | ||
|
|
@@ -196,17 +374,18 @@ s3.s5cmd.batch.max-size: 1024mb | |
| # Maximum number of files that will be uploaded via a single s5cmd call. | ||
| s3.s5cmd.batch.max-files: 100 | ||
| ``` | ||
|
|
||
| Both `s3.s5cmd.batch.max-size` and `s3.s5cmd.batch.max-files` control resource usage of the `s5cmd` binary to prevent it from overloading the task manager. | ||
|
|
||
| It is recommended to first configure and verify that Flink works without using `s5cmd`, then enable this feature. | ||
|
|
||
| #### Credentials | ||
|
|
||
| If you are using [access keys](#access-keys-discouraged), they will be passed to `s5cmd`. | ||
| Apart from that, `s5cmd` has its own independent way of [using credentials](https://github.com/peak/s5cmd?tab=readme-ov-file#specifying-credentials). | ||
|
|
||
| #### Limitations | ||
|
|
||
| Currently, Flink uses `s5cmd` only during recovery, when downloading state files from S3 and using RocksDB. | ||
|
|
||
| {{< top >}} | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we say it is (experimental) in the header of the referenced section?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good idea