[
https://issues.apache.org/jira/browse/SLIDER-131?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14035837#comment-14035837
]
Jonathan Maron commented on SLIDER-131:
---------------------------------------
There are a number of exposed UI and REST endpoints for the slider AM,
including:
1) Registry resources
2) Publisher resources
3) Management resources
4) AM UI
5) Agent resources
The agent resources are exposed for communication with the remote slider agents
running within spawned containers. The nature of their communication dictates
that, at a minimum, secure, one-way SSL transport is required. However, the
other HTTP resources currently exposed by the AM probably do not require SSL.
Therefore it seems appropriate to instantiate another HTTP server instance in
the AM, exposing a separate secured port, for the agent resources. This server
instance will:
- be configured with an HTTPS_ONLY HTTP policy
- be configured for one way SSL by default
- Alternatively be configurable for two-way SSL, though initial investigations
show that may require an AM restart (to reload newly uploaded client
certificates into the keystore/truststore), unless a custom reloadable trust
manager can be written and leveraged.
- keystore/truststore will be associated with node managers/hosts (i.e. the
location should be a writable, non-transient path on the host accessible to all
running containers)
> enable AM one and two-way SSL and test/enable agent secure comm
> ---------------------------------------------------------------
>
> Key: SLIDER-131
> URL: https://issues.apache.org/jira/browse/SLIDER-131
> Project: Slider
> Issue Type: Bug
> Components: agent, appmaster
> Reporter: Jonathan Maron
> Assignee: Jonathan Maron
>
> AM has ssl settings enabling SSL (including 2-way). Work through enabling
> this feature (perhaps initially testing it with a browser that has the
> appropriate server cert and client key), and subsequently try to ensure agent
> can communicate with server using both SSL modes.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
