You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fluss.apache.org by "affo (via GitHub)" <gi...@apache.org> on 2026/07/28 13:14:48 UTC
[I] [TLS] Add TLS transport encryption for Netty RPC (server + client) [fluss]
affo opened a new issue, #3792:
URL: https://github.com/apache/fluss/issues/3792
### Search before asking
- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.
### Description
Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).
Add TLS transport encryption to the Netty RPC layer, for both the server and the client, with **no authentication changes** — every existing auth protocol (`PLAINTEXT`, `SASL`) keeps working, now optionally over an encrypted channel.
Scope:
- `SslConfig`, `SslContextFactory`, `SslContextProvider` (including certificate hot-reload: periodic + reactive/self-healing reload, symlink-following change detection, keep-last-good-context on failed rebuild).
- `TlsFileRegionHandler` (handles the zero-copy/`sendfile` interaction — TLS disables zero-copy for log-fetch responses on a TLS-enabled listener; documented trade-off, same as Kafka).
- Server-side pipeline wiring: `ServerChannelInitializer`, `NettyServer`, `FlussProtocolPlugin` (SslHandler insertion, per-listener enablement via `security.ssl.enabled.listeners`).
- Client-side pipeline wiring: `NettyClient`, `ServerConnection` (SslHandler insertion, hostname verification).
- The transitional **optional-SSL** mode for the internal (server↔server) listener, enabling zero-downtime migration (`security.ssl.internal.accept-plaintext`).
- New config options: `security.ssl.*` (server) and `client.security.ssl.*` (client), except `security.ssl.principal.mapping.rules` (mTLS-only, deferred to the mTLS auth ticket).
- Metrics: `tls.handshake.failures` (counter), `tls.certificate.days.to.expiry` (gauge).
- Tests: `TlsClusterITCase`, `TlsDataPathITCase`, `SslContextFactoryTest`, `SslContextProviderTest`, `TestSslUtils`, plus `FlussClusterExtension` test-infra additions.
Out of scope (tracked separately): the mTLS authentication plugin / certificate-based `FlussPrincipal` derivation, and Flink/Spark connector pass-through validation.
### Willingness to contribute
- [x] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [TLS] Add TLS transport encryption for Netty RPC (server + client) [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo closed issue #3792: [TLS] Add TLS transport encryption for Netty RPC (server + client)
URL: https://github.com/apache/fluss/issues/3792
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [TLS] Add TLS transport encryption for Netty RPC (server + client) [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on issue #3792:
URL: https://github.com/apache/fluss/issues/3792#issuecomment-5104715461
Closing — created prematurely while we were still finalizing the PR-splitting plan for FIP-29 (#3786). Will reopen/recreate once the breakdown is settled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [TLS] Wire TLS encryption into the server Netty pipeline [fluss]
Posted by "polyzos (via GitHub)" <gi...@apache.org>.
polyzos closed issue #3792: [TLS] Wire TLS encryption into the server Netty pipeline
URL: https://github.com/apache/fluss/issues/3792
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [TLS] Wire TLS encryption into the server Netty pipeline [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on issue #3792:
URL: https://github.com/apache/fluss/issues/3792#issuecomment-5105157271
Reopening — scope narrowed after further discussion on splitting FIP-29's implementation into smaller, independently reviewable PRs. See #3786 for the full breakdown.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org