Multi-Cluster Security
A Repository Token configures connections to remote clusters. This token provides explicit access to the data within the view. Role Based Access Control (RBAC) controls security across the multi-cluster views and connections. For more information, see Users and Permissions.
The following sections describe security controls for the multi-cluster view, local connection, and remote connections:
The multi-cluster view requires a limited, read-only access token to a specific remote repository.
The multi-cluster view limits local connections to read-only access.
RBAC on the remote cluster controls remote connections within the Multi-Cluster view. Each remote view requires an explicit access token. The token controls access to a single view. When creating multiple multi-cluster views for the same remote repository, you can reuse the same token. Alternatively, create multiple tokens for more granular access control. For more information, see API Tokens.
Each multi-cluster view supports one remote connection per cluster.
The following table summarizes this information.
| View Security | Requires Token | Access Controlled By |
|---|---|---|
| Multi-Cluster View | No | Multi-Cluster View Cluster |
| Local Connection | No | Multi-Cluster View Cluster |
| Remote Connection | Yes | Remote Cluster |
You can revoke or delete the access token required for a remote connection. This removes access to the data from the multi-cluster view independently of other connections.
You must provide network access between upstream and downstream clusters. This network access supplements security authorization for local and remote data access. The required ports depend on your cluster configuration. You must include the default query port, 443.
When running queries through Multi-Cluster search:
The remote cluster executes queries as the user configured for the corresponding API token. It does not execute queries as the user on the parent cluster.
When viewing and auditing query execution:
Check humio-audit on the parent cluster for any multi-cluster queries.
Check humio-audit on child clusters for queries that are not multi-cluster.
You can correlate queries using the federationId in the audit log.