gaborgsomogyi opened a new pull request, #29289:
URL: https://github.com/apache/flink/pull/29289
## What is the purpose of the change
Flink's default SSL/TLS configuration currently limits negotiation to TLS
1.2 only. This pull request strengthens the default TLS posture so that
SSL-enabled deployments can negotiate TLS 1.3 out of the box, with automatic,
graceful fallback to TLS 1.2 for peers that do not support it yet. This only
affects deployments that already have SSL turned on
(`security.ssl.internal.enabled` / `security.ssl.rest.enabled` both default to
`false`), and anyone who needs to pin TLS 1.2 only can still do so via the
existing `security.ssl.protocol` / `security.ssl.algorithms` options.
## Brief change log
- Changed `SecurityOptions.SSL_PROTOCOL`'s default from `TLSv1.2` to
`TLSv1.2,TLSv1.3`
- Extended `SecurityOptions.SSL_ALGORITHMS`'s default to add TLS 1.3's own
cipher suites (`TLS_AES_128_GCM_SHA256`, `TLS_AES_256_GCM_SHA384`) alongside
the existing TLS 1.2 suites
- Regenerated the config documentation tables
(`security_configuration.html`, `security_ssl_section.html`) and updated the
narrative SSL setup guide (English and Chinese) to describe the new defaults
and the negotiation/fallback behavior
- Updated `SecurityOptionsTest` to assert the new
`security.ssl.algorithms` default and added a new test asserting the
`security.ssl.protocol` default
- Updated the end-to-end SSL test helper (`common_ssl.sh`) to explicitly
configure the new protocol and cipher defaults, so the existing
OpenSSL/netty-tcnative end-to-end test (`test_file_sink.sh`) exercises TLS 1.3
negotiation on CI
## Verifying this change
This change added a test and is otherwise already covered by existing tests:
- Added `SecurityOptionsTest#checkDefaultProtocol`, asserting
`SecurityOptions.SSL_PROTOCOL`'s default value
- Updated `SecurityOptionsTest#checkDefaultCipherSuite` to assert the new
`security.ssl.algorithms` default
- The exact target configuration (protocol `TLSv1.2,TLSv1.3` plus the
extended cipher list) is already exercised end to end by real socket-based
handshake tests in `SSLUtilsTest` (internal SSL, REST SSL, and the Blob socket
path) and `CustomSSLEngineProviderTest` (Pekko RPC), proving TLS 1.3 is
negotiated when both sides support it and that negotiation falls back
gracefully to TLS 1.2 otherwise
- Ran `SecurityOptionsTest`, `SSLUtilsTest`, and
`CustomSSLEngineProviderTest` locally; all pass
- The OpenSSL/netty-tcnative provider path is parameterized in the same
tests but can only be exercised in CI (native library not available in all
local dev environments); the updated `common_ssl.sh` gives this its first real
CI coverage under TLS 1.3
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changed class annotated with
`@Public(Evolving)`: yes, `SecurityOptions` is `@PublicEvolving`, but only
default *values* of two existing options change; no option is added, removed,
or renamed, and no signature changes
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its
components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable (existing SSL
documentation was updated to describe the new defaults)
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (Claude Code)
Generated-by: Claude Code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
