Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding deprecation info API check for misconfigured or ambiguous SSL settings #77092

Merged
merged 3 commits into from
Sep 3, 2021

Conversation

masseyke
Copy link
Member

In 8.0 we prevent the server from starting up if certain SSL properties are misconfigured or ambiguous. Specifically:

  1. The server lacks a certificate/key pair (i.e. neither ssl.keystore.path nor ssl.key/ssl.certificate are configured)
  2. The server has some ssl configuration, but ssl.enabled is not specified.

This commit adds a check to the deprecation info API for these changes.
Relates #42404 #45892

@masseyke masseyke requested review from jbaiera and tvernum August 31, 2021 22:49
@elasticmachine elasticmachine added the Team:Data Management Meta label for data/management team label Aug 31, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-data-management (Team:Data Management)

Copy link
Member

@jbaiera jbaiera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - Just one note about message wording that tripped my brain up.

keystorePathSettingKey, keyPathSettingKey, certificatePathSettingKey, enabledSettingKey);
details.add(detail);
} else if (keystorePathSettingExists && keyPathSettingExists && certificatePathSettingExists) {
String detail = String.format(Locale.ROOT, "all of [%s], [%s], and [%s] are set. Only [%s] or [%s] and [%s] can be " +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"x or y and z" scans a little strangely when reading for me. Maybe we rephrase to "Either x must be set or y and z must be set"

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the wording to make it more clear.

@masseyke masseyke merged commit a98df4e into elastic:7.x Sep 3, 2021
@masseyke masseyke deleted the feature/deprecation-info-ssl-config branch September 3, 2021 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>non-issue Team:Data Management Meta label for data/management team v7.16.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants