This is an automated email from the ASF dual-hosted git repository. haonan pushed a commit to branch metric_ssl in repository https://gitbox.apache.org/repos/asf/iotdb.git
commit bf069e27d0bdba960193172e753d4ac9f20a2456 Author: HTHou <[email protected]> AuthorDate: Fri Sep 5 11:32:20 2025 +0800 dev function --- .../apache/iotdb/metrics/config/MetricConfig.java | 36 ++++++++++++ .../reporter/iotdb/IoTDBSessionReporter.java | 6 +- .../reporter/prometheus/PrometheusReporter.java | 64 +++++++++++++++++++++- 3 files changed, 100 insertions(+), 6 deletions(-) diff --git a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/config/MetricConfig.java b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/config/MetricConfig.java index 8c179a816e1..1b9cafbe0cb 100644 --- a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/config/MetricConfig.java +++ b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/config/MetricConfig.java @@ -169,6 +169,42 @@ public class MetricConfig { this.prometheusReporterPassword = prometheusReporterPassword; } + public boolean isEnableSSL() { + return enableSSL; + } + + public String getKeyStorePath() { + return keyStorePath; + } + + public void setKeyStorePath(String keyStorePath) { + this.keyStorePath = keyStorePath; + } + + public String getKeyStorePassword() { + return keyStorePassword; + } + + public void setKeyStorePassword(String keyStorePassword) { + this.keyStorePassword = keyStorePassword; + } + + public String getTrustStorePath() { + return trustStorePath; + } + + public void setTrustStorePath(String trustStorePath) { + this.trustStorePath = trustStorePath; + } + + public String getTrustStorePassword() { + return trustStorePassword; + } + + public void setTrustStorePassword(String trustStorePassword) { + this.trustStorePassword = trustStorePassword; + } + public IoTDBReporterConfig getIoTDBReporterConfig() { return iotdbReporterConfig; } diff --git a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/iotdb/IoTDBSessionReporter.java b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/iotdb/IoTDBSessionReporter.java index 5d9d1105166..61e223d58f2 100644 --- a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/iotdb/IoTDBSessionReporter.java +++ b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/iotdb/IoTDBSessionReporter.java @@ -69,11 +69,11 @@ public class IoTDBSessionReporter extends IoTDBReporter { .user(ioTDBReporterConfig.getUsername()) .password(ioTDBReporterConfig.getPassword()) .maxSize(ioTDBReporterConfig.getMaxConnectionNumber()); - if () { + if (metricConfig.isEnableSSL()) { sessionPoolBuilder .useSSL(true) - .trustStore("") - .trustStorePwd(""); + .trustStore(metricConfig.getTrustStorePath()) + .trustStorePwd(metricConfig.getTrustStorePassword()); } this.sessionPool = sessionPoolBuilder.build(); try (SessionDataSetWrapper result = diff --git a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/prometheus/PrometheusReporter.java b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/prometheus/PrometheusReporter.java index 9bc8f2d9cae..9c1ec0890fe 100644 --- a/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/prometheus/PrometheusReporter.java +++ b/iotdb-core/metrics/interface/src/main/java/org/apache/iotdb/metrics/reporter/prometheus/PrometheusReporter.java @@ -39,6 +39,8 @@ import io.netty.channel.ChannelOption; import io.netty.channel.group.DefaultChannelGroup; import io.netty.handler.codec.http.HttpHeaderNames; import io.netty.handler.codec.http.HttpResponseStatus; +import io.netty.handler.ssl.SslContext; +import io.netty.handler.ssl.SslContextBuilder; import io.netty.util.concurrent.GlobalEventExecutor; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -48,10 +50,15 @@ import reactor.netty.http.server.HttpServer; import reactor.netty.http.server.HttpServerRequest; import reactor.netty.http.server.HttpServerResponse; +import javax.net.ssl.KeyManagerFactory; +import javax.net.ssl.TrustManagerFactory; + +import java.io.FileInputStream; import java.io.IOException; import java.io.StringWriter; import java.io.Writer; import java.nio.charset.StandardCharsets; +import java.security.KeyStore; import java.time.Duration; import java.util.Base64; import java.util.HashMap; @@ -81,7 +88,7 @@ public class PrometheusReporter implements Reporter { return false; } try { - httpServer = + HttpServer serverTransport = HttpServer.create() .option(ChannelOption.CONNECT_TIMEOUT_MILLIS, 2000) .channelGroup(new DefaultChannelGroup(GlobalEventExecutor.INSTANCE)) @@ -97,8 +104,25 @@ public class PrometheusReporter implements Reporter { } return res.header(HttpHeaderNames.CONTENT_TYPE, "text/plain") .sendString(Mono.just(scrape())); - })) - .bindNow(); + })); + if (METRIC_CONFIG.isEnableSSL()) { + serverTransport.secure( + spec -> { + SslContext sslContext; + try { + sslContext = + createSslContext( + METRIC_CONFIG.getKeyStorePath(), + METRIC_CONFIG.getKeyStorePassword(), + METRIC_CONFIG.getTrustStorePath(), + METRIC_CONFIG.getTrustStorePassword()); + } catch (Exception e) { + throw new RuntimeException(e); + } + spec.sslContext(sslContext); + }); + } + httpServer = serverTransport.bindNow(); } catch (Throwable e) { // catch Throwable rather than Exception here because the code above might cause a // NoClassDefFoundError @@ -257,6 +281,40 @@ public class PrometheusReporter implements Reporter { return result; } + private SslContext createSslContext( + String keystorePath, + String keystorePassword, + String truststorePath, + String truststorePassword) + throws Exception { + SslContextBuilder sslContextBuilder = null; + if (keystorePath != null && keystorePassword != null) { + KeyStore keyStore = KeyStore.getInstance("JKS"); + try (FileInputStream fis = new FileInputStream(keystorePath)) { + keyStore.load(fis, keystorePassword.toCharArray()); + } + KeyManagerFactory kmf = + KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); + kmf.init(keyStore, keystorePassword.toCharArray()); + sslContextBuilder = SslContextBuilder.forServer(kmf); + } + + if (sslContextBuilder != null && truststorePath != null && truststorePassword != null) { + KeyStore trustStore = KeyStore.getInstance("JKS"); + try (FileInputStream fis = new FileInputStream(truststorePath)) { + trustStore.load(fis, truststorePassword.toCharArray()); + } + TrustManagerFactory tmf = + TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + tmf.init(trustStore); + sslContextBuilder.trustManager(tmf); + } + if (sslContextBuilder == null) { + throw new Exception("Keystore or Truststore is null"); + } + return sslContextBuilder.build(); + } + @Override public boolean stop() { if (httpServer != null) {
