Yukang-Lian opened a new pull request, #67258:
URL: https://github.com/apache/doris/pull/67258
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
The BE-launched CDC process hard-codes HTTP for stream load and FE
callbacks. When an extension enables internal HTTP TLS, CDC jobs cannot load
data, commit offsets, report failures, query schemas, or download small files.
This change propagates the public BE HTTP TLS state and CA path into the CDC
process, constructs cluster-internal callback URLs with the active scheme, and
configures the CDC HTTP client to trust the configured CA. HTTPS is selected
only when TLS is enabled and HTTP is not listed in `tls_excluded_protocols`.
The default hostname verifier remains enabled. The CDC process's loopback-only
control endpoint remains HTTP because it is separate from Doris internal
cluster HTTP.
Client certificate and private-key loading for mutual TLS are intentionally
left to a separate follow-up.
### Release note
Support CDC internal callbacks over HTTPS when BE internal HTTP TLS is
enabled.
### Check List (For Author)
- Test
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
Validation performed:
- CDC URL, CA, schema, small-file, and request-builder tests: 34 tests
passed.
- CDC client module build completed successfully.
- `CdcClientMgrTest.*`: 29 tests passed under ASAN.
- Clang Format 16, clang-tidy, build hygiene, and `git diff --check`
passed.
- Behavior changed:
- [ ] No.
- [x] Yes. CDC cluster-internal HTTP calls now use HTTPS and the
configured CA when HTTP TLS is active.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
