[FLINK-11579] Support Netty SslEngine based on openSSL

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.9.0
• Component/s: Runtime / Network

Release Note

You can now optionally use openSSL as Flink's SSL engine. According to https://netty.io/wiki/requirements-for-4.x.html#wiki-h4-4, this is significantly faster. Please refer to https://ci.apache.org/projects/flink/flink-docs-release-1.9/ops/config.html#security-ssl-provider for the available options and how to set openSSL up.

• Assignee: Nico Kruber
• Reporter: Nico Kruber
• Created: 11/Feb/19 22:14
• Updated: 13/Oct/23 10:18
• Resolved: 15/Jun/19 23:20

Description

Since a while now, Netty does not only support the JDK's SSLEngine but also implements one based on openSSL which, according to https://netty.io/wiki/requirements-for-4.x.html#wiki-h4-4 is significantly faster. We should add support for using that engine instead.

Issue Links

• is duplicated by: FLINK-33178 Highly parallel apps suffer from bottleneck in NativePRNG
• is related to: LEGAL-393 Shipping boringssl/OpenSSL binaries along Apache Flink

Sub-Tasks

• Netty-fy the network SSL setup: Closed
• Support Netty configuration to enable an openSSL-based SslEngine: Closed
• Provide a shaded netty-tcnative: Closed
• Package flink-shaded-netty-tcnative-dynamic into opt/: Closed
• Add documentation how to enable openSSL: Closed
• Run network tests with dynamically-linked openSSL: Closed
• Run e2e tests with openSSL: Closed
• Document openSSL algorithm restrictions: Open