[FLINK-35371] Allow the keystore and truststore type to configured for SSL

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.19.0
• Fix Version/s: 1.20.0
• Component/s: Runtime / Network
• Labels: SSL pull-request-available
• Assignee: Ammar Master
• Reporter: Ammar Master
• Created: 16/May/24 05:25
• Updated: 14/Jun/24 16:32
• Resolved: 14/Jun/24 16:31

Description

Flink always creates a keystore and trustore using the default type defined in the JDK, which in most cases is JKS.

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());

We should add other configuration options to set the type explicitly to support other custom formats, and match the options provided by other applications by Spark and Kafka already. The default would continue to be specified by the JDK.

 

The SSLContext for the REST API can read the configuration option directly, and we need to add extra logic to the CustomSSLEngineProvider for Pekko.

Issue Links

• links to: GitHub Pull Request #24919