Yukang-Lian opened a new pull request, #67260:
URL: https://github.com/apache/doris/pull/67260
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
The unified TLS framework can switch the BE HTTP service to HTTPS, but
several
BE-to-BE clients still construct `http://` URLs and use the public
`HttpClient`
initialization path. This prevents TLS modules from consistently applying
client certificates, CA trust, and internal-only client policy.
This change:
- adds a public curl client-configuration hook with an OSS no-op and
explicitly
distinguishes trusted internal requests;
- derives internal HTTP URLs from unified TLS protocol selection while
preserving the legacy `enable_https` behavior;
- migrates clone, batch-download, snapshot/binlog, local audit stream-load,
and
small-file requests to internal HTTP initialization;
- advertises load-error and downloadable-load URLs with the effective scheme.
### Release note
BE internal HTTP clients and diagnostic URLs now honor the effective HTTP TLS
mode.
### Check List (For Author)
- Test
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
Validation:
- ASAN BE unit tests: `TlsProtocolConfigTest.*`, `FragmentMgrUrlTest.*`,
`HttpClientTest.get_internal`, and `HttpClientTest.batch_download` (6
passed).
- `build-support/check-format.sh` passed.
- `build-support/check-build-hygiene.sh` passed.
- `git diff --check` passed.
- Behavior changed:
- [ ] No.
- [x] Yes. BE internal URLs use HTTPS when HTTP TLS is enabled, and TLS
modules can configure trusted internal curl requests separately.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
