search

apache / pinot

Apache Pinot - A realtime distributed OLAP datastore
https://pinot.apache.org/
Apache License 2.0
5.38k stars 1.26k forks source link

Configure QueryServer and GrpcMailboxServer for TLS #11777

Open mgranderath opened 11 months ago

mgranderath commented 11 months ago

We have a requirement that all communication needs to be secured using mutual TLS, also Pinot internal communication. From our investigation we found that both GRPC servers for the multi-stage query engine (QueryServer and GrpcMailboxServer) do not follow the existing server TLS configuration and use plain-text communication.

Context

currently, Pinot multi-stage engine doesn't respect the cluster TLS configuration (see: https://github.com/apache/pinot/pull/8720 which only the user-facing connections are TLS configured)

we should enable TLS configuration for communication channels across

The solution should be fairly similar to the single-stage engine, which already supports channel TLS (#8207)

Additional Context

see Slack thread

anandheritage commented 11 months ago

@xiangfu0 Let me know if this should be fine as a beginner task. I can start with this.

mgranderath commented 2 months ago

Is there anything that I can do here to help get this across the line? We are still blocked from using the MSE due to this currently

anandheritage commented 2 months ago

@mgranderath Wasn't aware that it is blocking some major things. Will connect with you - I had raised the PR but because of the changes in the file - I need to rework on this

mgranderath commented 2 months ago

@anandheritage I'm in the slack workspace so you can message me there

anandheritage commented 1 month ago

@mgranderath Have started the work again : https://github.com/apache/pinot/pull/13645 Mostly like will finish off by the weekend.

If you have the access , kindly initiate the workflow for CI.