David Handermann created NIFI-16509:
---------------------------------------
Summary: Register Kubernetes HttpClientFactory for Loading Trust
Store
Key: NIFI-16509
URL: https://issues.apache.org/jira/browse/NIFI-16509
Project: Apache NiFi
Issue Type: Improvement
Components: Extensions
Reporter: David Handermann
Assignee: David Handermann
The {{nifi-kubernetes-client}} module includes a shared
{{StandardKubernetesClientProvider}} that handles construction of the Fabric8
{{KubernetesClient}} for Leader Election and ConfigMap operations. The default
behavior of the {{KubernetesClientBuilder}} attempts to add Kubernetes API
certificates to the configured trust store, but falls back to constructing a
new trust store using {{PKCS12}} when the configured [trust
store|https://github.com/fabric8io/kubernetes-client/blob/main/kubernetes-client-api/src/main/java/io/fabric8/kubernetes/client/internal/CertUtils.java#L119]
is not writable.
Rather than relying on this fallback behavior, a custom {{HttpClientFactory}}
should be implemented and registered to use the default Key Store Type for
constructing a new Trust Store, avoiding the hard-coding issues associated with
{{{}PKCS12{}}}.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
