[GitHub] [flink] dasbh opened a new pull request #10560: FLINK-15174 added certificate pinning for SSL mutual auth to further protect cluster

[GitBox <gi...@apache.org>]

dasbh opened a new pull request #10560: FLINK-15174 added certificate pinning for SSL mutual auth to further protect cluster
URL: https://github.com/apache/flink/pull/10560
 
 
   …protect the cluster when certificates are issued by public CA
   ## What is the purpose of the change
   
   *Allow the operator to specify the certificate fingerprint to further protect the cluster allowing only specific certificate*
   
   ## Brief change log
   
   *(for example:)*
     - *Conditionally replace default TrustMangerFactory with FingerprintTrustManagerFactory*
     - *For Akka use custom ssl-engine-provider to plug FingerprintTrustManagerFactory*
     - *Added tests to cover the changes*
   
   
   ## Verifying this change
   This change added tests and can be verified as follows:
   
   *(example:)*
     - *Added unit test for SSLUtils*
     - *Added unit test for AkkaUtils*
     - *Extended NettyClientServerSslTest for SSL pinning*
     - *Extended RestServerEndpointITCase for SSL pinning*
    
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): no
     - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
     - The serializers: no
     - The runtime per-record code paths (performance sensitive): don't know
     - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Yarn/Mesos, ZooKeeper:  don't know
     - The S3 file system connector: no
   
   ## Documentation
   
     - Does this pull request introduce a new feature? yes
     - If yes, how is the feature documented? documented
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services