Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add insecure mode when Pinot uses TLS connections #12525

Merged
merged 2 commits into from
Mar 11, 2024

Conversation

zhtaoxiang
Copy link
Contributor

@zhtaoxiang zhtaoxiang commented Feb 29, 2024

When Pinot is configured to use TLS as the communication protocol, we may want to turn off CA certificate verification in order to

  1. debug none-TLS related problems
  2. still keep Pinot running if there are CA certificates issues

This PR adds a "pinot.insecure.mode" configuration to make it possible. When "pinot.insecure.mode" is false, TLS communication runs as normal. When "pinot.insecure.mode" is true, all pinot components will skip CA certificate verification when communicating with other components.

Notice that to enable/disable this mode, we need to restart Pinot. We will make it dynamically configurable in the next PR. We will also add release note to the next PR.

@codecov-commenter
Copy link

codecov-commenter commented Feb 29, 2024

Codecov Report

Attention: Patch coverage is 24.13793% with 22 lines in your changes are missing coverage. Please review.

Project coverage is 61.71%. Comparing base (59551e4) to head (3244659).
Report is 34 commits behind head on master.

Files Patch % Lines
...ache/pinot/common/utils/tls/PinotInsecureMode.java 0.00% 4 Missing ⚠️
...va/org/apache/pinot/common/utils/tls/TlsUtils.java 0.00% 4 Missing ⚠️
...ache/pinot/common/utils/tls/RenewableTlsUtils.java 50.00% 1 Missing and 2 partials ⚠️
...pache/pinot/common/utils/grpc/GrpcQueryClient.java 0.00% 2 Missing ⚠️
...che/pinot/core/transport/grpc/GrpcQueryServer.java 0.00% 2 Missing ⚠️
...org/apache/pinot/core/util/ListenerConfigUtil.java 0.00% 2 Missing ⚠️
...ava/org/apache/pinot/minion/BaseMinionStarter.java 0.00% 2 Missing ⚠️
.../pinot/server/starter/helix/BaseServerStarter.java 0.00% 2 Missing ⚠️
...e/pinot/common/utils/tls/JvmDefaultSslContext.java 0.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #12525      +/-   ##
============================================
- Coverage     61.75%   61.71%   -0.04%     
  Complexity      207      207              
============================================
  Files          2436     2451      +15     
  Lines        133233   133570     +337     
  Branches      20636    20693      +57     
============================================
+ Hits          82274    82439     +165     
- Misses        44911    45035     +124     
- Partials       6048     6096      +48     
Flag Coverage Δ
custom-integration1 <0.01% <0.00%> (-0.01%) ⬇️
integration <0.01% <0.00%> (-0.01%) ⬇️
integration1 <0.01% <0.00%> (-0.01%) ⬇️
integration2 0.00% <0.00%> (ø)
java-11 61.68% <24.13%> (-0.03%) ⬇️
java-21 61.58% <24.13%> (-0.04%) ⬇️
skip-bytebuffers-false 61.71% <24.13%> (-0.04%) ⬇️
skip-bytebuffers-true 34.87% <10.34%> (+7.14%) ⬆️
temurin 61.71% <24.13%> (-0.04%) ⬇️
unittests 61.71% <24.13%> (-0.04%) ⬇️
unittests1 46.89% <14.28%> (+<0.01%) ⬆️
unittests2 27.67% <13.79%> (-0.06%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@xiangfu0 xiangfu0 added Configuration Config changes (addition/deletion/change in behavior) security labels Mar 1, 2024
@xiangfu0 xiangfu0 merged commit c72eadf into apache:master Mar 11, 2024
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Configuration Config changes (addition/deletion/change in behavior) security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants