apache / apache/pulsar

Add parameters for KeyStore TLS in Pulsar test client

Open
#22,678 0 comments 0 reactions 0 assignees View on GitHub
type/enhancement
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Motivation

If you want to create a TestClient which uses AuthenticationKeyStoreTls as its authPlugin, Pulsar Test Admin/Client utilized in Pulsar-perf is unable to setup a vaild SSL context due to the requirement of the property "useKeyStoreTls" to be "true" for using keystores properly.
Moreover, utilizing the property "useKeyStoreTls" requires the use of trust-store and not trust certificates, therefore requiring additional trustStoreType, trustStorePath and trustStorePass as parameters to be available, to utilize PulsarPerf.

The main reason to require this change is the following code in AsyncHttpConnector
```java
if (conf.isUseKeyStoreTls()) {
KeyStoreParams params = authData.hasDataForTls() ? authData.getTlsKeyStoreParams() :
new KeyStoreParams(conf.getTlsKeyStoreType(), conf.getTlsKeyStorePath(),
conf.getTlsKeyStorePassword());

final SSLContext sslCtx = KeyStoreSSLContext.createClientSslContext(
conf.getSslProvider(),
params.getKeyStoreType(),
params.getKeyStorePath(),
params.getKeyStorePassword(),
conf.isTlsAllowInsecureConnection(),
conf.getTlsTrustStoreType(),
conf.getTlsTrustStorePath(),
conf.getTlsTrustStorePassword(),
conf.getTlsCiphers(),
conf.getTlsProtocols());

JsseSslEngineFactory sslEngineFactory = new JsseSslEngineFactory(sslCtx);
confBuilder.setSslEngineFactory(sslEngineFactory);
}
```

I understand that users can just use AuthenticationTls instead of AuthenticationKeyStoreTls for Performance testing as it will work with the mTLS authentication scheme, but my motivation to provide these arguments is to allow for custom authentication/authorization providers that utilize keystores and want to perform performance testing using Pulsar Perf.

### Solution

Create new Arguments for the following properties, in PerformanceBaseArguments.java :
1. useKeyStoreTls
2. trustStoreType
3. trustStorePath
4. trustStorePass
5. keyStoreType
6. keyStorePath
7. keyStorePass

Update the code to change between TrustCerts and TrustStore based on useKeyStoreTls.

### Alternatives

An alternative solution is to update AuthenticationDataProviders that utilize keystores to override functions to provide trustStore as stream and the private key as well, not depending on the "useKeyStoreTls" property, but as we already have properties for trustStoreType, trustStorePath and trustStorePass which are only invoked when useKeyStoreTls is true, it makes more sense to expose these properties as parameters in Perf Clients.

### Anything else?

_No response_

### Are you willing to submit a PR?

- [X] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start in PerformanceBaseArguments.java and inspect how Pulsar Perf constructs its test client and configures TLS. Trace the existing TrustCerts and keystore paths, then expose the seven listed parameters and switch behavior according to useKeyStoreTls. Done means keystore-based TLS can be configured for the performance test client without breaking certificate-based TLS.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
performance, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.