data-prepper icon indicating copy to clipboard operation
data-prepper copied to clipboard

Centralize SSL configuration and certificate provider factory

Open chenqi0805 opened this issue 3 years ago • 3 comments

Is your feature request related to a problem? Please describe. The TLS/SSL config has not been unified across plugins (otel-trace-source, http, peerforwarder). It should be unifiable so that all plugins could reuse the same config and CertificateProviderFactory.

Describe the solution you'd like We need to sort out all necessary TLS/SSL config parameters and document them in a separate TLS/SSL module

Describe alternatives you've considered (Optional) A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context or screenshots about the feature request here.

chenqi0805 avatar Oct 06 '21 16:10 chenqi0805

I believe we can resolve this via the enhanced plugin support. This also means that new plugins can provide new implementations.

dlvenable avatar Oct 13 '21 18:10 dlvenable

This can be solved using plugins similar to what Data Prepper does for authentication (see #464).

Example for the file-based certificates:

http:
  ssl: true
  certificate:
    file:
      certificate_path: /usr/share/my/path/public.cert
      private_key_path: /usr/share/my/path/private.key

Example for the S3-based certificates:

http:
  ssl: true
  certificate:
    s3:
      certificate_uri: s3://mybucket/my/key/public.cert
      private_key_uri: s3://mybucket/my/key/private.key

Example for the ACM-based certificates:

http:
  ssl: true
  certificate:
    acm:
      arn: arn:...
      passphrase: secret

dlvenable avatar Dec 02 '21 20:12 dlvenable

Related issue to add support for AWS secrets manager #1679

asifsmohammed avatar Aug 19 '22 06:08 asifsmohammed

This would also be a great addition for Kafka topics

jverhoeks avatar Oct 12 '23 20:10 jverhoeks