[
https://issues.apache.org/jira/browse/HDDS-15817?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095377#comment-18095377
]
István Fajth commented on HDDS-15817:
-------------------------------------
I tentatively added the patch to the JIRA so that we have it here, and it is an
easy apply once the Ratis version is bumped to 3.3 after 3.3. ever gets
released.
What we need from 3.3 in order to make the functionality work:
https://issues.apache.org/jira/browse/RATIS-2537
https://issues.apache.org/jira/browse/RATIS-2596 - at the time of this comment
it is not merged yet.
https://issues.apache.org/jira/browse/RATIS-2598 - at the time of this comment
it is not merged yet.
> Apply configured gRPC TLS provider, protocols, and cipher suites to Ratis
> endpoints
> -----------------------------------------------------------------------------------
>
> Key: HDDS-15817
> URL: https://issues.apache.org/jira/browse/HDDS-15817
> Project: Apache Ozone
> Issue Type: Improvement
> Affects Versions: 2.3.0
> Reporter: István Fajth
> Assignee: István Fajth
> Priority: Major
> Attachments: HDDS-15817.patch
>
>
> Ozone exposes {{hdds.grpc.tls.provider}}, {{hdds.grpc.tls.protocols}}, and
> {{hdds.grpc.tls.ciphers}}, and already applies them to its directly-managed
> gRPC servers (the datanode data path, container replication, inter-SCM, and
> the OM S3 gateway). The Ratis-fronted endpoints, however — the SCM, OM, and
> datanode Raft servers and their clients — ignore these settings. As a result,
> operators can harden the TLS protocol versions, cipher suites, and SSL
> provider on most of Ozone's gRPC surface but not on the Raft ports, which
> stay on provider defaults.
> This task wires the existing {{hdds.grpc.tls.*}} settings into the TLS
> configuration Ozone hands to Ratis, so that the Raft server, client, admin,
> and data-stream endpoints enforce the same provider, protocol, and cipher
> policy as the rest of the gRPC servers. No new configuration keys are added,
> and behavior is unchanged when the settings are left unset.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
