Listener TLS customization #8082
Conversation
apucher
added
the
release-notes
apucher
force-pushed
the
listener-tls-customization
branch
from
3633704 to
88f040a
Compare
Codecov Report
@@ Coverage Diff @@
## master #8082 +/- ##
============================================
+ Coverage 71.17% 71.37% +0.19%
+ Complexity 4261 4197 -64
============================================
Files 1607 1607
Lines 83419 83464 +45
Branches 12460 12461 +1
============================================
+ Hits 59377 59570 +193
+ Misses 19995 19838 -157
- Partials 4047 4056 +9
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
| @@ -167,24 +172,38 @@ private ListenerConfigUtil() { | |||
| return listeners; | |||
| } | |||
|
|
|||
| private static ListenerConfig buildListenerConfig(PinotConfiguration config, String namespace, String protocol, | |||
| private static ListenerConfig buildListenerConfig(PinotConfiguration config, String namespace, String name, | |||
There was a problem hiding this comment.
（minor) why changing the parameter from protocol to name? protocol seems more clear to me
There was a problem hiding this comment.
the listener config originally required the listener name to be the protocol. now, the protocol can be configured separately from the listener name, i.e. it's possible to have two HTTPS listeners - one internally and the other externally.
There was a problem hiding this comment.
The idea is that you can run multiple listeners for the same protocol.
For example, running 2 https listeners serving different certificates with different keystore configurations. In that case, protocol is duplicate.
Description
Some enterprise scenarios require multiple TLS certs to be served by pinot components. The TLS specification (in Java) limits us to a single certificte per entry point, thus necessitating the creation of dedicated listeners per certificate.
This PR adds listener-specific TLS configuration options. It leverages the existing TLS settings as defaults and enables listener specs to override individual properties, including keystore, truststore, etc. The PR also contains a number of smaller enhancements and bug fixes to TLS support in pinot.
The PR further adds a dedicated integration test for TLS scenarios that test the correctness of accepting and rejecting secure connection attempts.
TlsIntegrationTest.javaserves as documentation for the use of the added featuresUpgrade Notes
Does this PR prevent a zero down-time upgrade? (Assume upgrade order: Controller, Broker, Server, Minion)
backward-incompat, and complete the section below on Release Notes)Does this PR fix a zero-downtime upgrade introduced earlier?
backward-incompat, and complete the section below on Release Notes)Does this PR otherwise need attention when creating release notes? Things to consider:
release-notesand complete the section on Release Notes)Release Notes
Listener specs can now use arbitrary names if they specify a protocol:
Listener specs can now override TLS settings on a per-property basis:
keystore.pathandtruststore.pathcan now point to URLs instead of local files onlyDocumentation