adityamparikh opened a new issue, #222:
URL: https://github.com/apache/solr-mcp/issues/222
### Current state (verified)
- `solr.username` / `solr.password` exist and work. They are absent from the
README configuration table (only `SOLR_URL` and `PROFILES` are listed).
- No TLS configuration. `SolrConfig` builds an `HttpJdkSolrClient` with no
`SSLContext`; the JDK default truststore is used.
### Motivation
A Solr Operator cluster with `spec.solrTLS` serves HTTPS from a certificate
signed by a private CA (typically cert-manager). The JDK default truststore
rejects it. Kubernetes stores that CA as PEM (`ca.crt`), so PEM must be
accepted directly.
### Scope
Add to `SolrConfigurationProperties`:
| Env var | Property | Notes |
|---|---|---|
| `SOLR_TLS_CA_PEM` | `solr.tls.ca-pem` | path to a PEM bundle; preferred on
Kubernetes |
| `SOLR_TLS_TRUSTSTORE` | `solr.tls.truststore` | path to PKCS12/JKS; for
non-k8s users |
| `SOLR_TLS_TRUSTSTORE_PASSWORD` | `solr.tls.truststore-password` | |
| `SOLR_TLS_TRUSTSTORE_TYPE` | `solr.tls.truststore-type` | default `PKCS12`
|
Setting both `ca-pem` and `truststore` is a startup error.
### Implementation notes
- `SolrConfig.buildSolrClient`: when either is set, build an `SSLContext` —
PEM via `CertificateFactory.getInstance("X.509")` + `KeyStore` +
`TrustManagerFactory`; truststore via `KeyStore.load` — and call
`HttpJdkSolrClient.Builder.withSSLContext(...)` (present in SolrJ; verified on
`apache/solr` `main`).
- Validation style should match #104.
- Native image: a new `SSLContext` path needs no extra reflection hints, but
confirm `native.yml` stays green.
- Docs: add `SOLR_USERNAME`, `SOLR_PASSWORD` and the four TLS variables to
the README table and `.env.example`.
### Acceptance
- [ ] Testcontainers test: Solr behind a self-signed cert — client connects
with `SOLR_TLS_CA_PEM`, fails without.
- [ ] Startup error when both PEM and truststore are set, and when
truststore password is set without a truststore.
- [ ] README/`.env.example` document all six variables. `native.yml` passes.
Part of the Kubernetes / Solr Operator integration tracking issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
