Major Description
The rest.advertised.listener config can currently be set to either "http" or "https", and a listener with that protocol should be used when advertising the URL of the worker to other members of the Connect cluster.
For example, someone might configure their worker with a listeners value of https://localhost:42069,http://localhost:4761 and a rest.advertised.listener value of http, which should cause the worker to listen on port 42069 with TLS and port 4761 with plaintext, and advertise the URL http://localhost:4761 to other workers.
However, the worker instead advertises the URL https://localhost:42069 to other workers. This is because the RestServer class, which is responsible for determining which URL to advertise to other workers, simply chooses the first listener whose name begins with the protocol specified in the rest.advertised.listener config.
This breaks because "http" is a prefix of "https", so if the advertised listener is "http" but the first listener that's found starts with "https://", that listener will still be chosen.
This bug has been present since SSL support (and the rest.advertised.listener config) were added via KIP-208, in release 1.1.0.
This bug should only present in the case where a user has set rest.advertised.listener to http but the listeners list begins with a listener that uses https. A workaround can be performed by changing the order of the listeners list to put the desired advertised listener at the beginning.
Attachments
Issue Links
- links to