Skip to content

Auto-reload TLS certs for druid endpoints #12933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FrankChen021 merged 8 commits into from
Aug 25, 2022
Merged

Auto-reload TLS certs for druid endpoints #12933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4eb9842
#12064 Auto-reload tls certs for druid endpoints
Aug 19, 2022
244ab19
#12064 Add missing toString param
Aug 19, 2022
d54936d
#12064 Add tests and new jks
Aug 22, 2022
f89f631
#12064 Refine tests
Aug 22, 2022
ba2b25d
#12064 Add documentation
Aug 22, 2022
da56b42
Merge branch 'apache:master' into master
santosh-d3vpl3x Aug 23, 2022
877c149
Apply suggestions from code review
santosh-d3vpl3x Aug 24, 2022
3af74a2
Merge branch 'apache:master' into master
santosh-d3vpl3x Aug 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions core/src/test/java/org/apache/druid/java/util/http/client/FriendlyServersTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.server.SslConnectionFactory;
import org.eclipse.jetty.util.ssl.KeyStoreScanner;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.jboss.netty.channel.ChannelException;
import org.jboss.netty.handler.codec.http.HttpMethod;
Expand Down Expand Up @@ -275,6 +276,8 @@ public void testFriendlySelfSignedHttpsServer() throws Exception

sslConnector.setPort(0);
server.setConnectors(new Connector[]{sslConnector});
KeyStoreScanner keyStoreScanner = new KeyStoreScanner(sslContextFactory);
Copy link
Copy Markdown
Contributor

@a2l007 a2l007 Aug 23, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This wouldn't detect keystore changes if the keystore path was a soft link, would it?

Copy link
Copy Markdown
Contributor Author

@santosh-d3vpl3x santosh-d3vpl3x Aug 23, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question, https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/tests/test-integration/src/test/java/org/eclipse/jetty/test/KeyStoreScannerTest.java#L182-L206 leads me to believe that it has that ability.

server.addBean(keyStoreScanner);
server.start();

try {
Expand Down
2 changes: 2 additions & 0 deletions docs/operations/tls-support.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ values for the configs below, among others provided by Java implementation.
|`druid.server.https.keyStoreType`|The type of the key store.|none|yes|
|`druid.server.https.certAlias`|Alias of TLS/SSL certificate for the connector.|none|yes|
|`druid.server.https.keyStorePassword`|The [Password Provider](../operations/password-provider.md) or String password for the Key Store.|none|yes|
|`druid.server.https.reloadSslContext`| Should Druid server detect Key Store file change and reload.|false|no|
|`druid.server.https.reloadSslContextSeconds`| How frequently should Druid server scan for Key Store file change.|60|yes|

The following table contains configuration options related to client certificate authentication.

Expand Down
18 changes: 18 additions & 0 deletions server/src/main/java/org/apache/druid/server/initialization/TLSServerConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,12 @@ public class TLSServerConfig
@JsonProperty
private String crlPath;

@JsonProperty
private boolean reloadSslContext = false;

@JsonProperty
private int reloadSslContextSeconds = 60;

public String getKeyStorePath()
{
return keyStorePath;
Expand Down Expand Up @@ -170,6 +176,16 @@ public String getCrlPath()
return crlPath;
}

public int getReloadSslContextSeconds()
{
return reloadSslContextSeconds;
}

public boolean isReloadSslContext()
{
return reloadSslContext;
}

@Override
public String toString()
{
Expand All @@ -189,6 +205,8 @@ public String toString()
", trustStoreAlgorithm='" + trustStoreAlgorithm + '\'' +
", validateHostnames='" + validateHostnames + '\'' +
", crlPath='" + crlPath + '\'' +
", reloadSslContext='" + reloadSslContext + '\'' +
", reloadSslContextSeconds='" + reloadSslContextSeconds + '\'' +
'}';
}
}
6 changes: 6 additions & 0 deletions server/src/main/java/org/apache/druid/server/initialization/jetty/JettyServerModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@
import org.eclipse.jetty.server.SslConnectionFactory;
import org.eclipse.jetty.server.handler.ErrorHandler;
import org.eclipse.jetty.util.component.LifeCycle;
import org.eclipse.jetty.util.ssl.KeyStoreScanner;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.eclipse.jetty.util.thread.QueuedThreadPool;
import org.eclipse.jetty.util.thread.ScheduledExecutorScheduler;
Expand Down Expand Up @@ -347,6 +348,11 @@ static Server makeAndInitializeServer(
}
connector.setPort(node.getTlsPort());
serverConnectors.add(connector);
if (tlsServerConfig.isReloadSslContext()) {
KeyStoreScanner keyStoreScanner = new KeyStoreScanner(sslContextFactory);
keyStoreScanner.setScanInterval(tlsServerConfig.getReloadSslContextSeconds());
server.addBean(keyStoreScanner);
}
} else {
sslContextFactory = null;
}
Expand Down
Loading