Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

separate function worker and broker client TLS configuration #6602

Merged
merged 2 commits into from
Apr 14, 2020
Merged

separate function worker and broker client TLS configuration #6602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
648ba97
separate function worker and broker client TLS configuration
Mar 25, 2020
f261b9c
Merge remote-tracking branch 'apache/master' into bugfix/issue-6521
codelipenghui Apr 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions conf/functions_worker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,12 @@ tlsAllowInsecureConnection: false
# Tls cert refresh duration in seconds (set 0 to check on every new connection)
tlsCertRefreshCheckDurationSec: 300

############################################
# security settings for pulsar broker client
############################################
# The path to trusted certificates used by the Pulsar client to authenticate with Pulsar brokers
brokerClientTrustCertsFilePath:

########################
# State Management
########################
Expand Down
10 changes: 9 additions & 1 deletion pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/worker/WorkerConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,7 +268,7 @@ public class WorkerConfig implements Serializable, PulsarConfiguration {
)
private String tlsKeyFilePath;
@FieldContext(
category = CATEGORY_SECURITY,
category = CATEGORY_WORKER_SECURITY,
doc = "Path for the trusted TLS certificate file"
)
private String tlsTrustCertsFilePath = "";
Expand Down Expand Up @@ -333,6 +333,14 @@ public boolean getTlsEnabled() {
return tlsEnabled || workerPortTls != null;
}

/******** security settings for pulsar broker client **********/

@FieldContext(
category = CATEGORY_CLIENT_SECURITY,
doc = "The path to trusted certificates used by the Pulsar client to authenticate with Pulsar brokers"
)
private String brokerClientTrustCertsFilePath;


/******** Function Runtime configurations **********/

Expand Down
13 changes: 11 additions & 2 deletions pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/WorkerService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,9 +125,18 @@ public void start(URI dlogUri,
: workerConfig.getWorkerWebAddress();

if (workerConfig.isAuthenticationEnabled()) {
// for compatible, if user do not define brokerClientTrustCertsFilePath, we will use tlsTrustCertsFilePath,
// otherwise we will use brokerClientTrustCertsFilePath
final String pulsarClientTlsTrustCertsFilePath;
if (StringUtils.isNotBlank(workerConfig.getBrokerClientTrustCertsFilePath())) {
pulsarClientTlsTrustCertsFilePath = workerConfig.getBrokerClientTrustCertsFilePath();
} else {
pulsarClientTlsTrustCertsFilePath = workerConfig.getTlsTrustCertsFilePath();
}

this.brokerAdmin = WorkerUtils.getPulsarAdminClient(workerConfig.getPulsarWebServiceUrl(),
workerConfig.getClientAuthenticationPlugin(), workerConfig.getClientAuthenticationParameters(),
workerConfig.getTlsTrustCertsFilePath(), workerConfig.isTlsAllowInsecureConnection(),
pulsarClientTlsTrustCertsFilePath, workerConfig.isTlsAllowInsecureConnection(),
workerConfig.isTlsHostnameVerificationEnable());

this.functionAdmin = WorkerUtils.getPulsarAdminClient(functionWebServiceUrl,
Expand All @@ -138,7 +147,7 @@ public void start(URI dlogUri,
this.client = WorkerUtils.getPulsarClient(this.workerConfig.getPulsarServiceUrl(),
workerConfig.getClientAuthenticationPlugin(),
workerConfig.getClientAuthenticationParameters(),
workerConfig.isUseTls(), workerConfig.getTlsTrustCertsFilePath(),
workerConfig.isUseTls(), pulsarClientTlsTrustCertsFilePath,
workerConfig.isTlsAllowInsecureConnection(), workerConfig.isTlsHostnameVerificationEnable());
} else {
this.brokerAdmin = WorkerUtils.getPulsarAdminClient(workerConfig.getPulsarWebServiceUrl());
Expand Down