michaeljmarshall commented on code in PR #15084:
URL: https://github.com/apache/pulsar/pull/15084#discussion_r846924879
##########
pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/worker/WorkerConfig.java:
##########
@@ -424,6 +428,74 @@ public boolean isBrokerClientAuthenticationEnabled() {
doc = "Tls cert refresh duration in seconds (set 0 to check on
every new connection)"
)
private long tlsCertRefreshCheckDurationSec = 300;
+
+ /**** --- KeyStore TLS config variables. --- ****/
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "Enable TLS with KeyStore type configuration in broker"
+ )
+ private boolean tlsEnabledWithKeyStore = false;
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS Provider for Specify the SSL provider for the broker
service: \n"
+ + "When using TLS authentication with CACert, the valid
value is either OPENSSL or JDK.\n"
+ + "When using TLS authentication with KeyStore, available
values can be SunJSSE, Conscrypt and etc."
+ )
+ private String tlsProvider = null;
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS KeyStore type configuration in broker: JKS, PKCS12"
+ )
+ private String tlsKeyStoreType = "JKS";
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS KeyStore path in broker"
+ )
+ private String tlsKeyStore = null;
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS KeyStore password for broker"
+ )
+ @ToString.Exclude
+ private String tlsKeyStorePassword = null;
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS TrustStore type configuration in broker: JKS, PKCS12"
+ )
+ private String tlsTrustStoreType = "JKS";
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS TrustStore path in broker"
+ )
+ private String tlsTrustStore = null;
+
+ @FieldContext(
+ category = CATEGORY_KEYSTORE_TLS,
+ doc = "TLS TrustStore password for broker, null means empty
password."
+ )
+ @ToString.Exclude
+ private String tlsTrustStorePassword = null;
+
+ @FieldContext(
+ category = CATEGORY_WORKER_SECURITY,
+ doc = "Specify the tls protocols the proxy's web service will use
to negotiate during TLS Handshake.\n\n"
+ + "Example:- [TLSv1.3, TLSv1.2]"
+ )
+ private Set<String> webServiceTlsProtocols = new TreeSet<>();
Review Comment:
I chose `webServiceTlsProtocols` because it matches the name of the same
configuration introduced in https://github.com/apache/pulsar/pull/13354 for
both the proxy and the broker web service. I think we should use the same
config name across all components to simplify configuration. However, I agree
that it'd probably be better to use `tlsProtocols` (and `tlsCiphers`) for all
configuration.
@Shoothzj - are you able to provide insight into your decision to add a new
configuration named `webServiceTlsProtocols` in #13354 instead of using the
existing `tlsProtocols` config?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
