data-prepper
data-prepper copied to clipboard
Centralize SSL configuration and certificate provider factory
Is your feature request related to a problem? Please describe. The TLS/SSL config has not been unified across plugins (otel-trace-source, http, peerforwarder). It should be unifiable so that all plugins could reuse the same config and CertificateProviderFactory.
Describe the solution you'd like We need to sort out all necessary TLS/SSL config parameters and document them in a separate TLS/SSL module
Describe alternatives you've considered (Optional) A clear and concise description of any alternative solutions or features you've considered.
Additional context Add any other context or screenshots about the feature request here.
I believe we can resolve this via the enhanced plugin support. This also means that new plugins can provide new implementations.
This can be solved using plugins similar to what Data Prepper does for authentication (see #464).
Example for the file-based certificates:
http:
ssl: true
certificate:
file:
certificate_path: /usr/share/my/path/public.cert
private_key_path: /usr/share/my/path/private.key
Example for the S3-based certificates:
http:
ssl: true
certificate:
s3:
certificate_uri: s3://mybucket/my/key/public.cert
private_key_uri: s3://mybucket/my/key/private.key
Example for the ACM-based certificates:
http:
ssl: true
certificate:
acm:
arn: arn:...
passphrase: secret
Related issue to add support for AWS secrets manager #1679
This would also be a great addition for Kafka topics