Skip to content

Commit 9fb286f

Browse files
EricWittmannEricWittmann
authored
Add consistent naming for KafkaSQL SSL security properties with backward compatibility (#6969)
Introduces new configuration properties with the consistent 'apicurio.kafkasql.security.ssl.*' prefix to align with existing security naming conventions. The old 'apicurio.kafkasql.ssl.*' properties are deprecated but remain fully functional through fallback logic. Users are warned via logging when using deprecated properties and are directed to the new property names. Fixes #6398
1 parent 6fff8d7 commit 9fb286f

File tree

2 files changed

+130
-17
lines changed

2 files changed

+130
-17
lines changed

‎app/src/main/java/io/apicurio/registry/storage/impl/kafkasql/KafkaSqlConfiguration.java‎

Lines changed: 100 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
import org.apache.kafka.common.config.SslConfigs;
1414
import org.apache.kafka.common.config.TopicConfig;
1515
import org.eclipse.microprofile.config.inject.ConfigProperty;
16+
import org.slf4j.Logger;
17+
import org.slf4j.LoggerFactory;
1618

1719
import java.time.Duration;
1820
import java.util.Map;
@@ -26,6 +28,8 @@
2628
@ApplicationScoped
2729
public class KafkaSqlConfiguration {
2830

31+
private static final Logger log = LoggerFactory.getLogger(KafkaSqlConfiguration.class);
32+
2933
/**
3034
* Configure number of partitions for Kafka topics created by Apicurio Registry.
3135
* If not provided, a value specified by the Kafka cluster configuration 'num.partitions' is used (except for the events topic, see below).
@@ -290,26 +294,66 @@ public Map<String, String> getAdminProperties() {
290294
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl truststore type")
291295
Optional<String> trustStoreType;
292296

293-
@ConfigProperty(name = "apicurio.kafkasql.ssl.truststore.password")
297+
@ConfigProperty(name = "apicurio.kafkasql.security.ssl.truststore.password")
294298
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl truststore password")
295299
Optional<String> trustStorePassword;
296300

297-
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.location")
301+
/**
302+
* @deprecated Use apicurio.kafkasql.security.ssl.truststore.password instead. This property will be removed in a future version.
303+
*/
304+
@Deprecated(since = "3.1.0", forRemoval = true)
305+
@ConfigProperty(name = "apicurio.kafkasql.ssl.truststore.password")
306+
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl truststore password (deprecated, use apicurio.kafkasql.security.ssl.truststore.password)")
307+
Optional<String> trustStorePasswordDeprecated;
308+
309+
@ConfigProperty(name = "apicurio.kafkasql.security.ssl.keystore.location")
298310
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore location")
299311
Optional<String> keyStoreLocation;
300312

301-
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.type")
313+
/**
314+
* @deprecated Use apicurio.kafkasql.security.ssl.keystore.location instead. This property will be removed in a future version.
315+
*/
316+
@Deprecated(since = "3.1.0", forRemoval = true)
317+
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.location")
318+
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore location (deprecated, use apicurio.kafkasql.security.ssl.keystore.location)")
319+
Optional<String> keyStoreLocationDeprecated;
320+
321+
@ConfigProperty(name = "apicurio.kafkasql.security.ssl.keystore.type")
302322
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore type")
303323
Optional<String> keyStoreType;
304324

305-
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.password")
325+
/**
326+
* @deprecated Use apicurio.kafkasql.security.ssl.keystore.type instead. This property will be removed in a future version.
327+
*/
328+
@Deprecated(since = "3.1.0", forRemoval = true)
329+
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.type")
330+
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore type (deprecated, use apicurio.kafkasql.security.ssl.keystore.type)")
331+
Optional<String> keyStoreTypeDeprecated;
332+
333+
@ConfigProperty(name = "apicurio.kafkasql.security.ssl.keystore.password")
306334
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore password")
307335
Optional<String> keyStorePassword;
308336

309-
@ConfigProperty(name = "apicurio.kafkasql.ssl.key.password")
337+
/**
338+
* @deprecated Use apicurio.kafkasql.security.ssl.keystore.password instead. This property will be removed in a future version.
339+
*/
340+
@Deprecated(since = "3.1.0", forRemoval = true)
341+
@ConfigProperty(name = "apicurio.kafkasql.ssl.keystore.password")
342+
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl keystore password (deprecated, use apicurio.kafkasql.security.ssl.keystore.password)")
343+
Optional<String> keyStorePasswordDeprecated;
344+
345+
@ConfigProperty(name = "apicurio.kafkasql.security.ssl.key.password")
310346
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl key password")
311347
Optional<String> keyPassword;
312348

349+
/**
350+
* @deprecated Use apicurio.kafkasql.security.ssl.key.password instead. This property will be removed in a future version.
351+
*/
352+
@Deprecated(since = "3.1.0", forRemoval = true)
353+
@ConfigProperty(name = "apicurio.kafkasql.ssl.key.password")
354+
@Info(category = CATEGORY_STORAGE, description = "Kafka sql storage ssl key password (deprecated, use apicurio.kafkasql.security.ssl.key.password)")
355+
Optional<String> keyPasswordDeprecated;
356+
313357
private void tryToConfigureClientSecurity(Map<String, String> props) {
314358
protocol.ifPresent(s -> props.putIfAbsent("security.protocol", s));
315359

@@ -324,18 +368,62 @@ private void tryToConfigureClientSecurity(Map<String, String> props) {
324368
props.putIfAbsent(SaslConfigs.SASL_MECHANISM, saslMechanism);
325369
props.putIfAbsent(SaslConfigs.SASL_LOGIN_CALLBACK_HANDLER_CLASS, loginCallbackHandler);
326370
}
371+
327372
// Try to configure the trustStore, if specified
328-
if (trustStoreLocation.isPresent() && trustStorePassword.isPresent() && trustStoreType.isPresent()) {
373+
// Use new property names, falling back to deprecated ones if new ones are not set
374+
Optional<String> effectiveTrustStorePassword = trustStorePassword.or(() -> {
375+
if (trustStorePasswordDeprecated.isPresent()) {
376+
log.warn("Configuration property 'apicurio.kafkasql.ssl.truststore.password' is deprecated and will be removed in a future version. "
377+
+ "Please migrate to 'apicurio.kafkasql.security.ssl.truststore.password'");
378+
}
379+
return trustStorePasswordDeprecated;
380+
});
381+
382+
if (trustStoreLocation.isPresent() && effectiveTrustStorePassword.isPresent() && trustStoreType.isPresent()) {
329383
props.putIfAbsent(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, trustStoreType.get());
330384
props.putIfAbsent(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, trustStoreLocation.get());
331-
props.putIfAbsent(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, trustStorePassword.get());
385+
props.putIfAbsent(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, effectiveTrustStorePassword.get());
332386
}
387+
333388
// Finally, try to configure the keystore, if specified
334-
if (keyStoreLocation.isPresent() && keyStorePassword.isPresent() && keyStoreType.isPresent()) {
335-
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, keyStoreType.get());
336-
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, keyStoreLocation.get());
337-
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, keyStorePassword.get());
338-
keyPassword.ifPresent(s -> props.putIfAbsent(SslConfigs.SSL_KEY_PASSWORD_CONFIG, s));
389+
// Use new property names, falling back to deprecated ones if new ones are not set
390+
Optional<String> effectiveKeyStoreLocation = keyStoreLocation.or(() -> {
391+
if (keyStoreLocationDeprecated.isPresent()) {
392+
log.warn("Configuration property 'apicurio.kafkasql.ssl.keystore.location' is deprecated and will be removed in a future version. "
393+
+ "Please migrate to 'apicurio.kafkasql.security.ssl.keystore.location'");
394+
}
395+
return keyStoreLocationDeprecated;
396+
});
397+
398+
Optional<String> effectiveKeyStoreType = keyStoreType.or(() -> {
399+
if (keyStoreTypeDeprecated.isPresent()) {
400+
log.warn("Configuration property 'apicurio.kafkasql.ssl.keystore.type' is deprecated and will be removed in a future version. "
401+
+ "Please migrate to 'apicurio.kafkasql.security.ssl.keystore.type'");
402+
}
403+
return keyStoreTypeDeprecated;
404+
});
405+
406+
Optional<String> effectiveKeyStorePassword = keyStorePassword.or(() -> {
407+
if (keyStorePasswordDeprecated.isPresent()) {
408+
log.warn("Configuration property 'apicurio.kafkasql.ssl.keystore.password' is deprecated and will be removed in a future version. "
409+
+ "Please migrate to 'apicurio.kafkasql.security.ssl.keystore.password'");
410+
}
411+
return keyStorePasswordDeprecated;
412+
});
413+
414+
Optional<String> effectiveKeyPassword = keyPassword.or(() -> {
415+
if (keyPasswordDeprecated.isPresent()) {
416+
log.warn("Configuration property 'apicurio.kafkasql.ssl.key.password' is deprecated and will be removed in a future version. "
417+
+ "Please migrate to 'apicurio.kafkasql.security.ssl.key.password'");
418+
}
419+
return keyPasswordDeprecated;
420+
});
421+
422+
if (effectiveKeyStoreLocation.isPresent() && effectiveKeyStorePassword.isPresent() && effectiveKeyStoreType.isPresent()) {
423+
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, effectiveKeyStoreType.get());
424+
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, effectiveKeyStoreLocation.get());
425+
props.putIfAbsent(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, effectiveKeyStorePassword.get());
426+
effectiveKeyPassword.ifPresent(s -> props.putIfAbsent(SslConfigs.SSL_KEY_PASSWORD_CONFIG, s));
339427
}
340428
}
341429
}

‎docs/modules/ROOT/partials/getting-started/ref-registry-all-configs.adoc‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -806,6 +806,31 @@ The following {registry} configuration options are available for each component
806806
|
807807
|
808808
|Kafka sql storage ssl truststore type
809+
|`apicurio.kafkasql.security.ssl.truststore.password`
810+
|`optional<string>`
811+
|
812+
|`3.1.0`
813+
|Kafka sql storage ssl truststore password
814+
|`apicurio.kafkasql.security.ssl.keystore.location`
815+
|`optional<string>`
816+
|
817+
|`3.1.0`
818+
|Kafka sql storage ssl keystore location
819+
|`apicurio.kafkasql.security.ssl.keystore.type`
820+
|`optional<string>`
821+
|
822+
|`3.1.0`
823+
|Kafka sql storage ssl keystore type
824+
|`apicurio.kafkasql.security.ssl.keystore.password`
825+
|`optional<string>`
826+
|
827+
|`3.1.0`
828+
|Kafka sql storage ssl keystore password
829+
|`apicurio.kafkasql.security.ssl.key.password`
830+
|`optional<string>`
831+
|
832+
|`3.1.0`
833+
|Kafka sql storage ssl key password
809834
|`apicurio.kafkasql.snapshot.every.seconds`
810835
|`string`
811836
|`86400s`
@@ -825,27 +850,27 @@ The following {registry} configuration options are available for each component
825850
|`optional<string>`
826851
|
827852
|
828-
|Kafka sql storage ssl key password
853+
|**DEPRECATED** - Use apicurio.kafkasql.security.ssl.key.password instead. This property will be removed in a future version.
829854
|`apicurio.kafkasql.ssl.keystore.location`
830855
|`optional<string>`
831856
|
832857
|
833-
|Kafka sql storage ssl keystore location
858+
|**DEPRECATED** - Use apicurio.kafkasql.security.ssl.keystore.location instead. This property will be removed in a future version.
834859
|`apicurio.kafkasql.ssl.keystore.password`
835860
|`optional<string>`
836861
|
837862
|
838-
|Kafka sql storage ssl keystore password
863+
|**DEPRECATED** - Use apicurio.kafkasql.security.ssl.keystore.password instead. This property will be removed in a future version.
839864
|`apicurio.kafkasql.ssl.keystore.type`
840865
|`optional<string>`
841866
|
842867
|
843-
|Kafka sql storage ssl keystore type
868+
|**DEPRECATED** - Use apicurio.kafkasql.security.ssl.keystore.type instead. This property will be removed in a future version.
844869
|`apicurio.kafkasql.ssl.truststore.password`
845870
|`optional<string>`
846871
|
847872
|
848-
|Kafka sql storage ssl truststore password
873+
|**DEPRECATED** - Use apicurio.kafkasql.security.ssl.truststore.password instead. This property will be removed in a future version.
849874
|`apicurio.kafkasql.topic`
850875
|`string`
851876
|`kafkasql-journal`

0 commit comments

Comments
 (0)