feature: support ssl communication for raft nodes #6926
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 2.x #6926 +/- ##
============================================
- Coverage 52.66% 52.65% -0.02%
- Complexity 6571 6573 +2
============================================
Files 1125 1125
Lines 39923 39940 +17
Branches 4677 4678 +1
============================================
+ Hits 21026 21030 +4
- Misses 16898 16911 +13
Partials 1999 1999
|
|
@Muluo-cyan Please register this PR in change logs[1]. [1]https://github.com/apache/incubator-seata/tree/2.x/changes |
slievrly
reviewed
Nov 5, 2024
There was a problem hiding this comment.
@Muluo-cyan can you add some configuration docs on seata website?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ⅰ. Describe what this PR did
Raft集群节点之间的通信现在支持开启ssl
The communication between nodes in the Raft cluster now supports SSL.
Ⅱ. Does this pull request fix one issue?
Ⅲ. Why don't you add test cases (unit test/integration test)?
Ⅳ. Describe how to verify it
server的application.yml中添加如下配置开启ssl支持。
Add the following configuration to the application.yml file on the server to enable SSL support.
server:
raft:
ssl:
enabled: true //是否开启ssl支持
keystore.type: pkcs12 //keystore类型
kmf.algorithm: SunX509 //kmf算法
server:
keystore: bolt.pfx //raft节点rpc服务端keystore文件路径
keystore.password: sfbolt //keystore密码
client:
keystore: cbolt.pfx //raft节点rpc客户端keystore文件路径
keystore.password: sfbolt //keystore密码
其中服务端 SSL keystore 文件 bolt.pfx 和客户端 SSL keystore 文件 cbolt.pfx 按照以下步骤生成：
The server-side SSL keystore file bolt.pfx and the client-side SSL keystore file cbolt.pfx can be generated using the following steps:
1.首先生成 keystore 并且导出其认证文件。
First, generate the keystore and export its certificate.
keytool -genkey -alias securebolt -keysize 2048 -validity 365 -keyalg RSA -dname "CN=localhost" -keypass sfbolt -storepass sfbolt -keystore bolt.pfx -deststoretype pkcs12
keytool -export -alias securebolt -keystore bolt.pfx -storepass sfbolt -file bolt.cer
2.接着生成客户端 keystore并且导出其认证文件。
Next, generate the client keystore and export its certificate.
keytool -genkey -alias smcc -keysize 2048 -validity 365 -keyalg RSA -dname "CN=localhost" -keypass sfbolt -storepass sfbolt -keystore cbolt.pfx -deststoretype pkcs12
keytool -export -alias smcc -keystore cbolt.pfx -storepass sfbolt -file cbolt.cer
3.最后导入服务端认证文件到客户端 keystore, 导入客户端认证文件到服务端 keystore。
Finally, import the server certificate into the client keystore and the client certificate into the server keystore.
keytool -import -trustcacerts -alias securebolt -file bolt.cer -storepass sfbolt -keystore cbolt.pfx
keytool -import -trustcacerts -alias smcc -file cbolt.cer -storepass sfbolt -keystore bolt.pfx
将生成的证书copy到每个节点。
然后启动seata集群，可以看到raft集群已经开启ssl支持，没有证书的节点与其他节点的通信会被拒绝
Copy the generated certificates to each node.
Then, start the Seata cluster. You should see that the Raft cluster has SSL support enabled, and any node without the certificate will have its communication with other nodes rejected.
Ⅴ. Special notes for reviews