Caideyipi opened a new pull request, #18080:
URL: https://github.com/apache/iotdb/pull/18080
## Summary
This PR extends the pipe thrift SSL sink path to support mutual SSL
authentication, following the general thrift client mTLS support added in
#18026.
## Changes
- Add pipe sink/connector SSL key-store parameters:
- `sink.ssl.key-store-path`
- `sink.ssl.key-store-pwd`
- `connector.ssl.key-store-path`
- `connector.ssl.key-store-pwd`
- Let `iotdb-thrift-ssl-sink` / `iotdb-thrift-ssl-connector` read both sink
and connector SSL aliases for:
- SSL enable flag
- trust store path/password
- key store path/password
- Pass the optional key store path/password through:
- `IoTDBSslSyncSink`
- `IoTDBSyncClientManager`
- `IoTDBSyncClient`
- DataNode sync sink/client manager
- ConfigNode sync sink/client manager
- Preserve existing one-way SSL behavior: key-store parameters are optional,
but if either key-store path or password is specified, both must be specified.
- Keep async thrift sink behavior explicit by rejecting all SSL attributes
there, including the new key-store attributes.
- Extend legacy pipe sink to accept connector/sink SSL aliases and to pass
key-store settings into both its thrift client and `SessionPool`.
- Hide `ssl.key-store-pwd` in pipe parameter value masking.
## Tests
- Added UT coverage for:
- `ssl.key-store-pwd` value hiding.
- DataRegion sync SSL sink accepting mutual SSL parameters.
- DataRegion sync SSL connector accepting connector-prefixed SSL aliases.
- DataRegion sync SSL sink rejecting incomplete key-store parameters.
- Async thrift sink rejecting SSL key-store parameters.
- Legacy pipe sink accepting connector-prefixed mutual SSL aliases.
- ConfigRegion sink accepting mutual SSL parameters.
- ConfigRegion sink rejecting incomplete key-store parameters.
- Added IT coverage:
- `IoTDBPipeMutualSSLIT` starts a receiver with thrift SSL client auth
enabled, creates an `iotdb-thrift-ssl-sink` pipe with trust/key stores, and
verifies pipe data transfer through a mutual-SSL receiver.
## Local Verification
- `mvn -Ddevelocity.off=true spotless:apply -pl
iotdb-api/pipe-api,iotdb-core/datanode,iotdb-core/confignode,integration-test
-P with-integration-tests`
- `git diff --check`
I also attempted targeted UT execution with `mvn -Ddevelocity.off=true test
-pl iotdb-api/pipe-api -Dtest=PipeParametersTest ...`, but the local Windows
environment failed to start/continue the JVM due to native memory/pagefile
exhaustion (`There is insufficient memory for the Java Runtime Environment to
continue`). The same environment issue also affected broader compile/test
attempts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
