You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by ja...@apache.org on 2026/04/27 16:07:27 UTC
(impala) 02/02: IMPALA-14898: Add TLS to External FE Port
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
commit e465a0b0c62e3927c9ed60a6c8c2e674f4626e32
Author: jasonmfehr <jf...@cloudera.com>
AuthorDate: Fri Apr 17 16:09:28 2026 -0700
IMPALA-14898: Add TLS to External FE Port
Adds TLS to the external fe Thrift server port in the same
manner as other Thrift servers are configured for TLS.
Testing accomplished by enhancing the tests in
test_server_tls.py to open an external fe port and check
that port to ensure it supports the allowed ciphersuites.
Change-Id: I240ebd631a6151bd5adf86231064471fe3d6fcd9
Generated-by: Github Copilot (GPT-5.3-Codex)
Reviewed-on: http://gerrit.cloudera.org:8080/24204
Reviewed-by: Jason Fehr <jf...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
be/src/service/impala-server.cc | 8 ++++++++
tests/custom_cluster/test_server_tls.py | 8 ++++++--
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/be/src/service/impala-server.cc b/be/src/service/impala-server.cc
index c3ee334a2..195ef9e6b 100644
--- a/be/src/service/impala-server.cc
+++ b/be/src/service/impala-server.cc
@@ -3354,6 +3354,14 @@ Status ImpalaServer::Start(int32_t beeswax_port, int32_t hs2_port,
ThriftServerBuilder builder(EXTERNAL_FRONTEND_SERVER_NAME, external_fe_processor,
external_fe_port);
ThriftServer* server;
+ if (IsExternalTlsConfigured()) {
+ LOG(INFO) << "Enabling SSL for External FE endpoint.";
+ builder.ssl(FLAGS_ssl_server_certificate, FLAGS_ssl_private_key)
+ .pem_password_cmd(FLAGS_ssl_private_key_password_cmd)
+ .ssl_version(ssl_version)
+ .cipher_list(FLAGS_ssl_cipher_list)
+ .tls_ciphersuites(FLAGS_tls_ciphersuites);
+ }
RETURN_IF_ERROR(
builder
.auth_provider(
diff --git a/tests/custom_cluster/test_server_tls.py b/tests/custom_cluster/test_server_tls.py
index 24aa6b3a1..2a9d9f382 100644
--- a/tests/custom_cluster/test_server_tls.py
+++ b/tests/custom_cluster/test_server_tls.py
@@ -29,6 +29,7 @@ from tests.common.impala_cluster import (
DEFAULT_ADMISSIOND_WEBSERVER_PORT, DEFAULT_STATESTORE_SERVICE_PORT,
DEFAULT_STATESTORE1_SERVICE_PORT, DEFAULT_STATESTORE_HA_SERVICE_PORT,
DEFAULT_PEER_STATESTORE_HA_SERVICE_PORT, DEFAULT_CATALOG_SERVICE_PORT,
+ DEFAULT_EXTERNAL_FE_PORT,
)
from tests.common.network import (
OPENSSL_TLS_1_2_CIPHERSUITES,
@@ -58,6 +59,7 @@ TLS_PORTS = [
DEFAULT_ADMISSIOND_STATE_STORE_SUBSCRIBER_PORT,
DEFAULT_ADMISSIOND_WEBSERVER_PORT,
DEFAULT_STATESTORE_HA_SERVICE_PORT,
+ DEFAULT_EXTERNAL_FE_PORT,
]
# TLS 1.2 RSA ciphersuites allowed by the cluster configuration.
@@ -310,7 +312,8 @@ class BaseTestServerTls(CustomClusterTestSuite):
admissiond_args=TLS_RSA_LOCALHOST_ARGS,
start_args="--enable_admission_service "
"--enable_statestored_ha "
- "--enable_catalogd_ha")
+ "--enable_catalogd_ha "
+ "--enable_external_fe_support")
class TestServerTlsRSA(BaseTestServerTls):
"""
Spins up a cluster configured to use TLS with RSA certificates and runs webserver
@@ -335,7 +338,8 @@ class TestServerTlsRSA(BaseTestServerTls):
admissiond_args=TLS_ECDSA_LOCALHOST_ARGS,
start_args="--enable_admission_service "
"--enable_statestored_ha "
- "--enable_catalogd_ha")
+ "--enable_catalogd_ha "
+ "--enable_external_fe_support")
class TestServerTlsECDSA(BaseTestServerTls):
"""
Spins up a cluster configured to use TLS with ECDSA certificates and runs webserver