Hi Lorenzo, thank you for the really nice and detailed FIP. May I suggest attaching the link to the proposal? https://cwiki.apache.org/confluence/display/FLUSS/FIP-29%3A+%28m%29TLS+Support
Overall the proposal looks great and looks solid to me. Two questions I have just for clarity: 1. Netty’s SslHandler can’t encrypt a FileRegion.. Does this mean that TLS enables clients will lose zero-copy? Or is there a workaround for this? If not I think maybe it would be good to explicitly mention this in the proposal so users are aware of this trade-off 2. Does the design assume always short-lived credentials? Overall it looks good to me and it’s a +1 on my side. Best, Giannis On Fri, 12 Jun 2026 at 5:44 PM, Lorenzo Affetti via dev < [email protected]> wrote: > Hello community! > > I would like to start a discussion about FIP-29: (m)TLS support. > > Here is the motivation: > > All Fluss RPC traffic — between clients and servers, and between servers — > currently travels over the network *in plaintext*. > > This has two consequences: > > 1. *Confidentiality.* Table data, metadata, and even the credentials > exchanged by the existing application-layer authentication are visible > to > anyone able to observe the network. In shared, cloud, or multi-tenant > deployments this is unacceptable. > 2. *Strong client authentication.* Fluss has a pluggable authentication > framework, but it has no certificate-based mechanism. Operators who > standardize on PKI / mutual TLS for service-to-service identity (a very > common requirement) cannot integrate Fluss. > > This FIP adds: > > - *TLS transport encryption* for the Netty RPC layer, enabled per server > listener and on the client. > - *Mutual TLS (mTLS) authentication*, where the server derives the > authenticated FlussPrincipal from the client's X.509 certificate, > integrated into the existing authentication/authorization pipeline. > > > Eager to hear about your thoughts! > > -- > Lorenzo Affetti > Team Leader of Stream Storage > [email protected] > www.ververica.com > ------------------------------ > > <https://www.ververica.com/> > Ververica GmbH | Herzogspitalstrasse 24 | 80331 München | Germany > <https://www.google.com/maps/search/Herzogspitalstrasse+24+%7C+80331+M%C3%BCnchen+%7C+Germany?entry=gmail&source=g> > > Follow us: > <https://www.linkedin.com/company/ververica/posts/?feedView=all> > <https://www.youtube.com/@ververica> > <https://open.spotify.com/show/2XME9h8iBOyr6YupqM99ir?si=87b064644add42a1 > >Available > on: <https://aws.amazon.com/marketplace/pp/prodview-luvmqd6leha4i> > < > https://marketplace.microsoft.com/en-us/product/saas/ververica.vvc_managed?tab=Overview > > > > Pflichtangaben/Mandatory Information > <https://www.ververica.com/mandatory-information> >
