JNSimba opened a new pull request, #686: URL: https://github.com/apache/doris-flink-connector/pull/686
# Proposed changes Issue Number: N/A ## Problem Summary: Add opt-in one-way TLS support for Doris connections made through HTTP/Stream Load, MySQL/JDBC, BE Thrift, and Arrow Flight SQL. - Add a unified TLS policy with PEM CA trust, hostname verification control, and explicit per-protocol exclusions. - Propagate the policy through Source, Sink, Catalog, old Source API, InputFormat, and CDC entry points for both Flink 1 and Flink 2. - Keep TLS disabled by default, reject HTTPS-to-HTTP redirect downgrades, and avoid changing JVM-global TLS state. - Scope JDBC temporary truststores to the connection provider lifecycle and keep Doris API trust separate from pre-signed object-storage URLs. - Document certificate distribution for Standalone, YARN, and Kubernetes deployments. This change does not add mutual TLS. The new options are: - `doris.enable.tls` - `doris.tls.ca-certificate-path` - `doris.tls.skip-hostname-verification` - `doris.tls.excluded-protocols` (`http`, `mysql`, `thrift`, `arrowflight`) ## Checklist(Required) 1. Does it affect the original behavior: No. TLS remains disabled unless explicitly enabled. 2. Has unit tests been added: Yes. 3. Has document been added or modified: Yes. 4. Does it need to update dependencies: No. 5. Are there any changes that cannot be rolled back: No. ## Test Results - JDK 8, Flink 1.20 reactor clean test: base 344 tests and Flink 1 module 48 tests, 0 failures and 0 errors. - JDK 17, Flink 2.2 reactor clean test: base 344 tests and Flink 2 module 13 tests, 0 failures and 0 errors. - JDK 17 Spotless checks passed for base, Flink 1, and Flink 2 modules. - Clean shaded-package builds passed for Flink 1 on JDK 8 and Flink 2 on JDK 17. - Live TLS environment: strict JDBC query succeeded with the configured CA; FE HTTPS request returned 200; a Flink Thrift source read 3 rows; a Flink HTTPS Stream Load sink wrote and verified 3 rows. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
