nevzheng opened a new pull request, #12011:
URL: https://github.com/apache/gravitino/pull/12011
### What changes were proposed in this pull request?
Add HTTPS and mutual TLS support to the Gravitino Java client.
This change:
- Adds a `TLSConfigurer` API to `GravitinoClient`, `GravitinoAdminClient`,
and `HTTPClient`.
- Loads optional client keystores and server truststores from environment
variables.
- Uses explicit `TLSConfigurer`, environment variables, then JVM defaults as
precedence.
- Validates incomplete and invalid TLS configuration.
- Updates `docs/security/how-to-use-https.md` with three client use cases:
- Use HTTPS to encrypt traffic and verify the server.
- Trust internal servers whose private CA is not trusted by the JVM.
- Use mTLS to restrict connections to certified clients.
- Links the certificate instructions from
`docs/how-to-use-gravitino-client.md`.
### Why are the changes needed?
The server can require and validate client certificates, but the Java client
cannot currently present one.
This change enables HTTPS with custom trust material and mTLS client
certificates. The certificate controls whether the connection is accepted; the
`Authorization` header still determines the Gravitino user.
Fix: #9836
### Does this PR introduce _any_ user-facing change?
Yes.
A new `withTlsConfigurer` client API is available.
The following environment variables are added:
- `GRAVITINO_CLIENT_TLS_KEY_STORE_PATH`
- `GRAVITINO_CLIENT_TLS_KEY_STORE_PASSWORD`
- `GRAVITINO_CLIENT_TLS_KEY_STORE_TYPE`
- `GRAVITINO_CLIENT_TLS_TRUST_STORE_PATH`
- `GRAVITINO_CLIENT_TLS_TRUST_STORE_PASSWORD`
- `GRAVITINO_CLIENT_TLS_TRUST_STORE_TYPE`
Store types default to `PKCS12`. There is no default file location.
### How was this patch tested?
Tests cover:
- JVM defaults when TLS configuration is absent.
- Explicit configuration taking precedence over environment configuration.
- Incomplete and invalid store configuration.
- Passwords not appearing in errors.
- Rejection when a required client certificate is absent.
- Successful connection with a trusted client certificate.
Commands run:
`./gradlew :clients:client-java:spotlessCheck :clients:client-java:test
:clients:client-java:javadoc -PskipITs`
`./gradlew :docs:build`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
