Skip to content

Commit 53325aa

Browse files
zhangshenghangzhangshenghang
authored
[Feature][Zeta] Support enable https protocol for rest-api v2 (#9010)
1 parent 8a9db47 commit 53325aa

File tree

21 files changed

+787
-22
lines changed

21 files changed

+787
-22
lines changed

Diff for: ‎docs/en/seatunnel-engine/rest-api-v1.md

-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
---
2-
sidebar_position: 11
3-
---
4-
51
# RESTful API V1
62

73
:::caution warn

Diff for: ‎docs/en/seatunnel-engine/rest-api-v2.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
---
2-
sidebar_position: 12
3-
---
4-
51
# RESTful API V2
62

73
SeaTunnel has a monitoring API that can be used to query status and statistics of running jobs, as well as recent
@@ -37,6 +33,10 @@ seatunnel:
3733
context-path: /seatunnel
3834
```
3935
36+
## Enable HTTPS
37+
38+
Please refer [security](security.md)
39+
4040
## API reference
4141
4242
### Returns an overview over the Zeta engine cluster.

Diff for: ‎docs/en/seatunnel-engine/security.md

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Security
2+
3+
## HTTPS Configuration
4+
5+
You can secure your REST-API-V2 service by enabling HTTPS. Both HTTP and HTTPS can be enabled simultaneously, or only one of them can be enabled.
6+
7+
| Parameter Name | Required | Description |
8+
|----------------|----------|-------------|
9+
| `enable-http` | No | Whether to enable HTTP service, default is `true` |
10+
| `port` | No | HTTP service port, default is `8080` |
11+
| `enable-https` | No | Whether to enable HTTPS service, default is `false` |
12+
| `https-port` | No | HTTPS service port, default is `8443` |
13+
| `key-store-path` | Required when `enable-https` is `true` | Path to the KeyStore file, used to store the server's private key and certificate |
14+
| `key-store-password` | Required when `enable-https` is `true` | KeyStore password |
15+
| `key-manager-password` | Required when `enable-https` is `true` | KeyManager password, usually the same as the KeyStore password |
16+
| `trust-store-path` | No | Path to the TrustStore file, used to verify client certificates |
17+
| `trust-store-password` | No | TrustStore password |
18+
19+
**Note**: When `trust-store-path` and `trust-store-password` are not empty, mutual SSL authentication (client authentication) will be enabled, requiring the client to provide a valid certificate.
20+
21+
```yaml
22+
seatunnel:
23+
engine:
24+
http:
25+
enable-http: true
26+
port: 8080
27+
enable-https: true
28+
https-port: 8443
29+
key-store-path: "${YOUR_KEY_STORE_PATH}"
30+
key-store-password: "${YOUR_KEY_STORE_PASSWORD}"
31+
key-manager-password: "${YOUR_KEY_MANAGER_PASSWORD}"
32+
# Optional: Mutual authentication
33+
trust-store-path: "${YOUR_TRUST_STORE_PATH}"
34+
trust-store-password: "${YOUR_TRUST_STORE_PASSWORD}"
35+
```
36+
37+
### Example of Generating Keys
38+
39+
```shell
40+
#!/bin/bash
41+
42+
# Define the project root directory
43+
PROJECT_DIR="/Users/mac/IdeaProjects/data"
44+
45+
# Define passwords
46+
SERVER_KEYSTORE_PASSWORD="server_keystore_password"
47+
SERVER_KEY_PASSWORD="server_keystore_password"
48+
CLIENT_KEYSTORE_PASSWORD="client_keystore_password"
49+
CLIENT_KEY_PASSWORD="client_keystore_password"
50+
SERVER_TRUSTSTORE_PASSWORD="server_truststore_password"
51+
CLIENT_TRUSTSTORE_PASSWORD="client_truststore_password"
52+
53+
# Generate server keystore
54+
keytool -genkeypair \
55+
-alias server \
56+
-keyalg RSA \
57+
-keysize 2048 \
58+
-validity 365 \
59+
-keystore "$PROJECT_DIR/server_keystore.jks" \
60+
-storepass "$SERVER_KEYSTORE_PASSWORD" \
61+
-keypass "$SERVER_KEY_PASSWORD" \
62+
-dname "CN=localhost,OU=IT,O=MyCompany,L=Shanghai,ST=Shanghai,C=CN"
63+
64+
# Export server certificate
65+
keytool -exportcert \
66+
-alias server \
67+
-keystore "$PROJECT_DIR/server_keystore.jks" \
68+
-storepass "$SERVER_KEYSTORE_PASSWORD" \
69+
-file "$PROJECT_DIR/server.crt"
70+
71+
# Generate client keystore
72+
keytool -genkeypair \
73+
-alias client \
74+
-keyalg RSA \
75+
-keysize 2048 \
76+
-validity 365 \
77+
-keystore "$PROJECT_DIR/client_keystore.jks" \
78+
-storepass "$CLIENT_KEYSTORE_PASSWORD" \
79+
-keypass "$CLIENT_KEY_PASSWORD" \
80+
-dname "CN=client,OU=IT,O=MyCompany,L=Shanghai,ST=Shanghai,C=CN"
81+
82+
# Export client certificate
83+
keytool -exportcert \
84+
-alias client \
85+
-keystore "$PROJECT_DIR/client_keystore.jks" \
86+
-storepass "$CLIENT_KEYSTORE_PASSWORD" \
87+
-file "$PROJECT_DIR/client.crt"
88+
89+
# Create server truststore and import client certificate
90+
keytool -importcert \
91+
-alias client \
92+
-file "$PROJECT_DIR/client.crt" \
93+
-keystore "$PROJECT_DIR/server_truststore.jks" \
94+
-storepass "$SERVER_TRUSTSTORE_PASSWORD" \
95+
-noprompt
96+
97+
# Create client truststore and import server certificate
98+
keytool -importcert \
99+
-alias server \
100+
-file "$PROJECT_DIR/server.crt" \
101+
-keystore "$PROJECT_DIR/client_truststore.jks" \
102+
-storepass "$CLIENT_TRUSTSTORE_PASSWORD" \
103+
-noprompt
104+
```

Diff for: ‎docs/sidebars.js

+9-2
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,15 @@ const sidebars = {
208208
"seatunnel-engine/engine-jar-storage-mode",
209209
"seatunnel-engine/tcp",
210210
"seatunnel-engine/resource-isolation",
211-
"seatunnel-engine/rest-api-v1",
212-
"seatunnel-engine/rest-api-v2",
211+
{
212+
"type": "category",
213+
"label": "RESTFul API",
214+
"items": [
215+
"seatunnel-engine/rest-api-v1",
216+
"seatunnel-engine/rest-api-v2",
217+
"seatunnel-engine/security"
218+
]
219+
},
213220
"seatunnel-engine/user-command",
214221
"seatunnel-engine/logging",
215222
"seatunnel-engine/telemetry",

Diff for: ‎docs/zh/seatunnel-engine/rest-api-v1.md

-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
---
2-
sidebar_position: 11
3-
---
4-
51
# RESTful API V1
62

73
:::caution warn

Diff for: ‎docs/zh/seatunnel-engine/rest-api-v2.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
---
2-
sidebar_position: 12
3-
---
4-
51
# RESTful API V2
62

73
SeaTunnel有一个用于监控的API，可用于查询运行作业的状态和统计信息，以及最近完成的作业。监控API是RESTful风格的，它接受HTTP请求并使用JSON数据格式进行响应。
@@ -35,6 +31,10 @@ seatunnel:
3531
context-path: /seatunnel
3632
```
3733
34+
## 开启 HTTPS
35+
36+
请参考 [security](security.md)
37+
3838
## API参考
3939
4040
### 返回Zeta集群的概览

Diff for: ‎docs/zh/seatunnel-engine/security.md

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
sidebar_position: 16
3+
---
4+
5+
# Security
6+
7+
## HTTPS 配置
8+
9+
您可以通过开启 HTTPS 来保护您的 API 服务。HTTP 和 HTTPS 可同时开启，也可以只开启其中一个。
10+
11+
| 参数名称 | 是否必填 | 参数描述 |
12+
|--------|---------|--------|
13+
| `enable-http` | 否 | 是否开启 HTTP 服务，默认为 `true` |
14+
| `port` | 否 | HTTP 服务端口，默认为 `8080` |
15+
| `enable-https` | 否 | 是否开启 HTTPS 服务，默认为 `false` |
16+
| `https-port` | 否 | HTTPS 服务端口，默认为 `8443` |
17+
| `key-store-path` | 当 `enable-https` 为 `true` 时必填 | KeyStore 文件路径，用于存储服务器私钥和证书 |
18+
| `key-store-password` | 当 `enable-https` 为 `true` 时必填 | KeyStore 密码 |
19+
| `key-manager-password` | 当 `enable-https` 为 `true` 时必填 | KeyManager 密码，通常与 KeyStore 密码相同 |
20+
| `trust-store-path` | 否 | TrustStore 文件路径，用于验证客户端证书 |
21+
| `trust-store-password` | 否 | TrustStore 密码 |
22+
23+
**注意**：当 `trust-store-path` 和 `trust-store-password` 配置项不为空时，将启用双向 SSL 认证（客户端认证），要求客户端提供有效证书。
24+
25+
```yaml
26+
seatunnel:
27+
engine:
28+
http:
29+
enable-http: true
30+
port: 8080
31+
enable-https: true
32+
https-port: 8443
33+
key-store-path: "${YOUR_KEY_STORE_PATH}"
34+
key-store-password: "${YOUR_KEY_STORE_PASSWORD}"
35+
key-manager-password: "${YOUR_KEY_MANAGER_PASSWORD}"
36+
# 可选：双向认证
37+
trust-store-path: "${YOUR_TRUST_STORE_PATH}"
38+
trust-store-password: "${YOUR_TRUST_STORE_PASSWORD}"
39+
```
40+
41+
### 生成密钥样例
42+
43+
```shell
44+
#!/bin/bash
45+
46+
# 定义项目根目录
47+
PROJECT_DIR="/Users/mac/IdeaProjects/data"
48+
49+
# 定义密码
50+
SERVER_KEYSTORE_PASSWORD="server_keystore_password"
51+
SERVER_KEY_PASSWORD="server_keystore_password"
52+
CLIENT_KEYSTORE_PASSWORD="client_keystore_password"
53+
CLIENT_KEY_PASSWORD="client_keystore_password"
54+
SERVER_TRUSTSTORE_PASSWORD="server_truststore_password"
55+
CLIENT_TRUSTSTORE_PASSWORD="client_truststore_password"
56+
57+
# 生成服务端密钥库
58+
keytool -genkeypair \
59+
-alias server \
60+
-keyalg RSA \
61+
-keysize 2048 \
62+
-validity 365 \
63+
-keystore "$PROJECT_DIR/server_keystore.jks" \
64+
-storepass "$SERVER_KEYSTORE_PASSWORD" \
65+
-keypass "$SERVER_KEY_PASSWORD" \
66+
-dname "CN=localhost,OU=IT,O=MyCompany,L=Shanghai,ST=Shanghai,C=CN"
67+
68+
# 导出服务端证书
69+
keytool -exportcert \
70+
-alias server \
71+
-keystore "$PROJECT_DIR/server_keystore.jks" \
72+
-storepass "$SERVER_KEYSTORE_PASSWORD" \
73+
-file "$PROJECT_DIR/server.crt"
74+
75+
# 生成客户端密钥库
76+
keytool -genkeypair \
77+
-alias client \
78+
-keyalg RSA \
79+
-keysize 2048 \
80+
-validity 365 \
81+
-keystore "$PROJECT_DIR/client_keystore.jks" \
82+
-storepass "$CLIENT_KEYSTORE_PASSWORD" \
83+
-keypass "$CLIENT_KEY_PASSWORD" \
84+
-dname "CN=client,OU=IT,O=MyCompany,L=Shanghai,ST=Shanghai,C=CN"
85+
86+
# 导出客户端证书
87+
keytool -exportcert \
88+
-alias client \
89+
-keystore "$PROJECT_DIR/client_keystore.jks" \
90+
-storepass "$CLIENT_KEYSTORE_PASSWORD" \
91+
-file "$PROJECT_DIR/client.crt"
92+
93+
# 创建服务端信任库并导入客户端证书
94+
keytool -importcert \
95+
-alias client \
96+
-file "$PROJECT_DIR/client.crt" \
97+
-keystore "$PROJECT_DIR/server_truststore.jks" \
98+
-storepass "$SERVER_TRUSTSTORE_PASSWORD" \
99+
-noprompt
100+
101+
# 创建客户端信任库并导入服务端证书
102+
keytool -importcert \
103+
-alias server \
104+
-file "$PROJECT_DIR/server.crt" \
105+
-keystore "$PROJECT_DIR/client_truststore.jks" \
106+
-storepass "$CLIENT_TRUSTSTORE_PASSWORD" \
107+
-noprompt
108+
```

Diff for: ‎seatunnel-ci-tools/src/test/java/org/apache/seatunnel/api/file/AllFileSpecificationCheckTest.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ public class AllFileSpecificationCheckTest {
4646
@BeforeAll
4747
public static void beforeAll() throws IOException {
4848
List<String> fileTypesCanNotRead =
49-
Arrays.asList("parquet", "orc", "xlsx", "xls", "png", "jar", "lzo", "zip", "ico");
49+
Arrays.asList(
50+
"parquet", "orc", "xlsx", "xls", "png", "jar", "lzo", "zip", "ico", "jks");
5051
List<String> fileCanNotRead =
5152
Arrays.asList(
5253
"seatunnel-connectors-v2/connector-file/connector-file-base/src/test/resources/encoding/gbk.json",

Diff for: ‎seatunnel-engine/seatunnel-engine-common/src/main/java/org/apache/seatunnel/engine/common/config/YamlSeaTunnelDomConfigProcessor.java

+31
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,37 @@ private HttpConfig parseHttpConfig(Node httpNode) {
518518
getIntegerValue(
519519
ServerConfigOptions.MasterServerConfigOptions.PORT_RANGE.key(),
520520
getTextContent(node)));
521+
} else if (ServerConfigOptions.MasterServerConfigOptions.ENABLE_HTTPS
522+
.key()
523+
.equals(name)) {
524+
httpConfig.setEnableHttps(getBooleanValue(getTextContent(node)));
525+
} else if (ServerConfigOptions.MasterServerConfigOptions.HTTPS_PORT
526+
.key()
527+
.equals(name)) {
528+
httpConfig.setHttpsPort(
529+
getIntegerValue(
530+
ServerConfigOptions.MasterServerConfigOptions.HTTPS_PORT.key(),
531+
getTextContent(node)));
532+
} else if (ServerConfigOptions.MasterServerConfigOptions.KEY_STORE_PATH
533+
.key()
534+
.equals(name)) {
535+
httpConfig.setKeyStorePath(getTextContent(node));
536+
} else if (ServerConfigOptions.MasterServerConfigOptions.KEY_STORE_PASSWORD
537+
.key()
538+
.equals(name)) {
539+
httpConfig.setKeyStorePassword(getTextContent(node));
540+
} else if (ServerConfigOptions.MasterServerConfigOptions.KEY_MANAGER_PASSWORD
541+
.key()
542+
.equals(name)) {
543+
httpConfig.setKeyManagerPassword(getTextContent(node));
544+
} else if (ServerConfigOptions.MasterServerConfigOptions.TRUST_STORE_PATH
545+
.key()
546+
.equals(name)) {
547+
httpConfig.setTrustStorePath(getTextContent(node));
548+
} else if (ServerConfigOptions.MasterServerConfigOptions.TRUST_STORE_PASSWORD
549+
.key()
550+
.equals(name)) {
551+
httpConfig.setTrustStorePassword(getTextContent(node));
521552
} else {
522553
LOGGER.warning("Unrecognized element: " + name);
523554
}

Diff for: ‎seatunnel-engine/seatunnel-engine-common/src/main/java/org/apache/seatunnel/engine/common/config/server/HttpConfig.java

+27
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,33 @@ public class HttpConfig implements Serializable {
3131

3232
private int port = ServerConfigOptions.MasterServerConfigOptions.PORT.defaultValue();
3333

34+
/** Whether to enable https. */
35+
private boolean enableHttps =
36+
ServerConfigOptions.MasterServerConfigOptions.ENABLE_HTTPS.defaultValue();
37+
38+
/** The port of https. */
39+
private int httpsPort = ServerConfigOptions.MasterServerConfigOptions.HTTPS_PORT.defaultValue();
40+
41+
/** The path of keystore file. */
42+
private String keyStorePath =
43+
ServerConfigOptions.MasterServerConfigOptions.KEY_STORE_PATH.defaultValue();
44+
45+
/** The password of keystore file. */
46+
private String keyStorePassword =
47+
ServerConfigOptions.MasterServerConfigOptions.KEY_STORE_PASSWORD.defaultValue();
48+
49+
/** The password of key manager. */
50+
private String keyManagerPassword =
51+
ServerConfigOptions.MasterServerConfigOptions.KEY_MANAGER_PASSWORD.defaultValue();
52+
53+
/** The path of truststore file. */
54+
private String trustStorePath =
55+
ServerConfigOptions.MasterServerConfigOptions.TRUST_STORE_PATH.defaultValue();
56+
57+
/** The password of truststore file. */
58+
private String trustStorePassword =
59+
ServerConfigOptions.MasterServerConfigOptions.TRUST_STORE_PASSWORD.defaultValue();
60+
3461
private String contextPath =
3562
ServerConfigOptions.MasterServerConfigOptions.CONTEXT_PATH.defaultValue();
3663

0 commit comments

Comments
 (0)