You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by GitBox <gi...@apache.org> on 2022/05/30 02:53:25 UTC
[GitHub] [kafka] RivenSun2 opened a new pull request, #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
RivenSun2 opened a new pull request, #12226:
URL: https://github.com/apache/kafka/pull/12226
As mentioned in [KIP-651](https://cwiki.apache.org/confluence/display/KAFKA/KIP-651+-+Support+PEM+format+for+SSL+certificates+and+private+key)
> A new key store type `PEM` will be added for key and trust stores. Both ssl.keystore.type and ssl.truststore.type may specify PEM in addition to JKS and PKCS12.
Now the documentation of these two parameters does not indicate which optional values are available, only a default value is shown.
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] mimaison merged pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
mimaison merged PR #12226:
URL: https://github.com/apache/kafka/pull/12226
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on PR #12226:
URL: https://github.com/apache/kafka/pull/12226#issuecomment-1144788954
Hi @mimaison
Could you help to review this PR?
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887686539
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
In the default implementation class `DefaultSslEngineFactory`, the supported values for these two parameters are `[JKS , PKCS12, PEM]`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887935524
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
From the existing documentation, the user does not know what other values to choose than `JKS`. Unless they read the source code or related [KIP-651.](https://cwiki.apache.org/confluence/display/KAFKA/KIP-651+-+Support+PEM+format+for+SSL+certificates+and+private+key)
I think adding a supplement to the documentation here to show what values are supported by default in Kafka can help users better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887982361
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
ok i will improve the documentation later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] dajac commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
dajac commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887910416
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
If the accepted values depends on `ssl.engine.factory.class`, why would we want to add them to the documentation of `ssl.keystore.type`? This is misleading for users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on PR #12226:
URL: https://github.com/apache/kafka/pull/12226#issuecomment-1144437378
Hi @showuon
Could you help to review this PR?
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] dajac commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
dajac commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887970373
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
In this case, we should be clear about the fact that those are only accepted by the default `ssl.engine.factory.class`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] dajac commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
dajac commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887615311
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
Our documentation generator has the ability to get the supported values from the validator. Here is an example:
```
.define(LogMessageTimestampTypeProp, STRING, Defaults.LogMessageTimestampType, in("CreateTime", "LogAppendTime"), MEDIUM, LogMessageTimestampTypeDoc)
```
Have you considered doing something similar here? Is there a reason not to do this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887664798
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
Hi @dajac Thank you for your reply.
As I mentioned in JIRA:
> I'm not sure if it's appropriate to add a validator here. I just want to supplement the documentation.
Maybe users can customize their own SslEngineFactory through the `ssl.engine.factory.class` parameter to support other values than [JKS , PKCS12, PEM].
Now the documentation for these two parameters does not show any other optional values except for a default value of `JKS`. This can confuse users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887686539
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
In the default implementation class `DefaultSslEngineFactory`, the supported values for these two parameters are `[JKS,
PKCS12, PEM]`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on a diff in pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on code in PR #12226:
URL: https://github.com/apache/kafka/pull/12226#discussion_r887935524
##########
clients/src/main/java/org/apache/kafka/common/config/SslConfigs.java:
##########
@@ -69,7 +69,7 @@ public class SslConfigs {
public static final String SSL_KEYSTORE_TYPE_CONFIG = "ssl.keystore.type";
public static final String SSL_KEYSTORE_TYPE_DOC = "The file format of the key store file. "
- + "This is optional for client.";
+ + "This is optional for client. The currently supported values for kafka are [JKS , PKCS12, PEM].";
Review Comment:
From the existing documentation, the user does not know what other values to choose than JKS. Unless they read the source code or related [KIP-651.](https://cwiki.apache.org/confluence/display/KAFKA/KIP-651+-+Support+PEM+format+for+SSL+certificates+and+private+key)
I think adding a supplement to the documentation here to show what values are supported by default in Kafka can help users better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on PR #12226:
URL: https://github.com/apache/kafka/pull/12226#issuecomment-1158580834
Hi @mimaison could we merge this PR?
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on PR #12226:
URL: https://github.com/apache/kafka/pull/12226#issuecomment-1140633118
Hi @dajac
Could you help to review this PR?
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] RivenSun2 commented on pull request #12226: KAFKA-13890: Improve documentation of `ssl.keystore.type` and `ssl.truststore.type`
Posted by GitBox <gi...@apache.org>.
RivenSun2 commented on PR #12226:
URL: https://github.com/apache/kafka/pull/12226#issuecomment-1146948144
Hi @dajac and @mimaison
Could you help to review this PR?
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org