DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Related Research
Detailed Design
Organize http interface documents
1. FE Interface Authentication And Https Implementation
Http Interface Authentication
For unauthenticated http interfaces, execute CheckPassword and CheckGlobalAuth or CheckDbAuth or CheckTblAuth;
For partially authenticated http interfaces, only CheckPassword is executed, but CheckGlobalAuth or CheckDbAuth or CheckTblAuth is not executed.
Execute CheckGlobalAuth or CheckDbAuth or CheckTblAuth based on the permissions required by the interface, as shown in follow table:
接口名称 | 功能描述 | RequestMapping | 是否鉴权 |
MetaService | fe 元数据相关API，除`/dump` 以外，都为fe 节点之间内部通讯用，/dump 用于获取image 文件的存储路径 |
| 否（checkFromValidFe）1 |
BackendsAction | 返回be 列表，包括IP、PORT 等信息 | GET /api/backends | 是（executeCheckPassword） |
GetSmallFileAction | 下载在文件管理器中的文件 | GET /api/get_small_file?token=xxx&file_id=xxx | 否（executeCheckPassword + checkGlobalAuth-PrivPredicate.ADMIN） |
HealthAction | 返回集群当前存活与宕机的be 节点数 | GET /api/health | 否（executeCheckPassword） |
MetaInfoAction | 获取集群内的元数据信息 |
| 是（checkWithCookie） |
ShowAction | 获取集群/数据库的相关信息 |
| 否（executeCheckPassword + checkGlobalAuth-PrivPredicate.ADMIN）1，3，4 |
StmtExecutionAction |
|
| 是（checkWithCookie） |
MetricsAction | 获取metrics | GET /metrics | 否（executeCheckPassword） |
BootstrapFinishAction | 判断fe 是否启动完成 | GET /api/bootstrap | 否（executeCheckPassword） |
ExtraBasepathAction | 返回接口API 的base path | GET /api/basepath | 否（executeCheckPassword） |
ImportAction | 查看格式为CSV 或PARQUET 的文件内容 | POST /api/import/file_review | 否（executeCheckPassword） |
StatisticAction | 获取集群统计信息、库表数量等 | GET /rest/v2/api/cluster_overview | 否（executeCheckPassword） |
Https Implementation
We implement https based on spring boot, and implement https through configuration and http coding.
- Generate an SSL Certificate
- Test environment certificate is generated using keytool or openssl, and production environment certificate is purchased from the CA.
- Configure https in Spring Boot
- Add ssl certificate configuration items in the fe configuration file, including the port number, certificate path, password, format, alias, and enable or disable (ssl is disabled by default).
http_port
https_port = 8040
ssl_key_store_path
ssl_key_store_password
ssl_key_store_type
ssl_key_store_alias
ssl_enable - When fe is started, related configuration parameters are read into the HttpServer class, and then ssl parameters are configured using SpringApplicationBuilder().properties(properties).
server.port = https_port // https端口
server.http.port = http_port // http端口
server.ssl.key-store = ssl_key_store_path // 证书路径
server.ssl.key-store-password = ssl_key_store_password // 证书密码
server.ssl.key-store-type = ssl_key_store_type // 密钥库类型
server.ssl.keyalias: ssl_key_store_alias // 证书别名
server.ssl.enabled = ssl_enable // 是否开启ssl
- Add ssl certificate configuration items in the fe configuration file, including the port number, certificate path, password, format, alias, and enable or disable (ssl is disabled by default).
- Implement http connector and redirect http requests to https
- Construct the httpConnector and set the http port and https port.
- Through TomcatServletWebServerFactory::addAdditionalTomcatConnectors() to add multiple surveillance connection.
2.BE Interface Authentication And Https Implementation
...