Yukang-Lian opened a new pull request, #68054:
URL: https://github.com/apache/doris/pull/68054
### What problem does this PR solve?
Issue Number: N/A
Related PR: N/A
Problem Summary:
Several internal HTTP, CDC, Arrow Flight, BDBJE, Thrift, and
regression-client paths did not consistently honor the configured TLS mode.
Some paths still constructed plaintext URLs, while pooled Thrift transports
could attempt to reopen connections that are not reopenable under TLS.
This PR aligns these public communication paths with the existing TLS
configuration while preserving generic JDBC connections for external systems
and temporary plaintext test clusters.
### What is changed?
- Make FE, BE, cloud, and CDC internal HTTP paths TLS-aware through public
provider hooks and protocol-specific configuration.
- Advertise secure Arrow Flight endpoints and reuse BDBJE network settings.
- Support framed blocking Thrift servers and rebuild pooled Thrift clients
when a TLS transport cannot be reopened.
- Use a TLS-safe group-commit redirect fallback when the BE forwarding hop
cannot run over TLS.
- Apply configured TLS to Doris JDBC, HTTP, debug-point, and 2PC regression
paths without modifying external JDBC URLs.
- Redact JDBC credentials from regression framework logs.
### Validation
- Focused FE unit tests passed: `ThriftServerTest`, `GenericPoolTest`,
`HttpURLUtilTest`, `LoadActionTest`, `OssInternalHttpClientProviderTest`,
`BDBEnvironmentTest`, and `DorisFlightSqlProducerTest`.
- CDC unit tests passed: 6 tests across `EnvTest` and `HttpUtilTest`.
- Regression framework unit tests passed: `SuiteContextConnectTest` (10
tests).
- Focused BE unit tests passed: 6 tests across `TlsProtocolConfigTest`,
`FragmentMgrUrlTest`, `HttpClientTest`, and `CdcClientMgrTest`.
- All 75 changed Groovy suites parsed successfully with Groovy 4.0.19.
- Clang-format checks passed for the changed C++ files.
- `git diff --check` passed.
### Release note
Improve TLS support for internal communication paths and Doris regression
clients.
### Check List (For Author)
- Test
- [x] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
- Behavior changed:
- [ ] No.
- [x] Yes. Internal communication paths honor the configured TLS mode.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
