You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "liuml07 (via GitHub)" <gi...@apache.org> on 2024/02/05 20:17:34 UTC
[PR] Support providing SSL context in sink builder [flink-connector-elasticsearch]
liuml07 opened a new pull request, #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2058403397
@liuml07 thanks for the contribution
it seems the ci failed because of `spotless`
could you please apply spotless to the PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on code in PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#discussion_r1574279683
##########
flink-connector-elasticsearch-base/src/main/java/org/apache/flink/connector/elasticsearch/sink/ElasticsearchSinkBuilderBase.java:
##########
@@ -263,6 +271,41 @@ public B setSocketTimeout(int timeout) {
return self();
}
+ /**
+ * Allows to bypass the certificates chain validation and connect to insecure network endpoints
+ * (for example, servers which use self-signed certificates).
+ *
+ * @param allowInsecure allow or not to insecure network endpoints
+ * @return this builder
+ */
+ public B setAllowInsecure(boolean allowInsecure) {
+ this.allowInsecure = allowInsecure;
+ return self();
Review Comment:
Since there is overlap between this setting and suppliers, you may just rely on SSL context supplier here:
```
this.allowInsecure = allowInsecure;
if (this.allowInsecure) {
return setSslContextSupplier(SSLContexts.custom().loadTrustMaterial(TrustAllStrategy.INSTANCE)::build);
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2068657077
@reta may I ask you to have another review iteration please?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support providing SSL context in sink builder [flink-connector-elasticsearch]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-1928024803
Thanks for opening this pull request! Please check out our contributing guidelines. (https://flink.apache.org/contributing/how-to-contribute.html)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "liuml07 (via GitHub)" <gi...@apache.org>.
liuml07 commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2058316069
@reta Thanks for the advice. I have updated the patch accordingly. I think the `allowInsecure` and the `sslContextSupplier` are mutually exclusive, so I added some validation and unit test for that. I can work on a separate on for table if this looks right.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2012289683
@liuml07 could you please use the same configuration/API model as [1] does for SSL support in OpenSearch? Besides just having familiar configuration, the API is friendly to SQL connector (where providing hostname verifier could be challenging), thank you.
The idea basically is that `NetworkClientConfig` has a setting):
- allowInsecure: booleab (uses trustall model in case of self-signed certs)
- you could certainly also keep more elaborate configuration with SSLContext / SSLEngine / ... in case it is needed
Thank you.
[1] https://github.com/apache/flink-connector-opensearch/tree/main/flink-connector-opensearch
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "liuml07 (via GitHub)" <gi...@apache.org>.
liuml07 commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2092337019
Thanks for reviewing and your approval. Could you help merge this @reta?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on code in PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#discussion_r1574288489
##########
flink-connector-elasticsearch-base/src/main/java/org/apache/flink/connector/elasticsearch/sink/ElasticsearchWriter.java:
##########
@@ -161,17 +166,46 @@ private static RestClientBuilder configureRestClientBuilder(
if (networkClientConfig.getConnectionPathPrefix() != null) {
builder.setPathPrefix(networkClientConfig.getConnectionPathPrefix());
}
- if (networkClientConfig.getPassword() != null
- && networkClientConfig.getUsername() != null) {
- final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
- credentialsProvider.setCredentials(
- AuthScope.ANY,
- new UsernamePasswordCredentials(
- networkClientConfig.getUsername(), networkClientConfig.getPassword()));
+
+ final CredentialsProvider credentialsProvider = getCredentialsProvider(networkClientConfig);
+ if (credentialsProvider != null
+ || networkClientConfig.isAllowInsecure().orElse(Boolean.FALSE)
Review Comment:
I think wiring `allowInsecure` through sslContextSupplier (here https://github.com/apache/flink-connector-elasticsearch/pull/91/files#r1574279683) would make the logic simpler
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2092439455
Awesome work, congrats on your first merged pull request!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91#issuecomment-2092439228
Thanks for the contribution @liuml07
Thanks for the review @reta
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-34369][connectors/elasticsearch] Elasticsearch connector supports SSL context [flink-connector-elasticsearch]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin merged PR #91:
URL: https://github.com/apache/flink-connector-elasticsearch/pull/91
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org