Commit 57076e64a6f8158e259a60446f3f5085fce07899

Authored by Trevor Muraro
Committed by Andrew Shvayka
1 parent 7ffd5a0e

Add full DataStax Java Driver SSL configs

@@ -194,8 +194,21 @@ cassandra: @@ -194,8 +194,21 @@ cassandra:
194 url: "${CASSANDRA_URL:127.0.0.1:9042}" 194 url: "${CASSANDRA_URL:127.0.0.1:9042}"
195 # Specify local datacenter name 195 # Specify local datacenter name
196 local_datacenter: "${CASSANDRA_LOCAL_DATACENTER:datacenter1}" 196 local_datacenter: "${CASSANDRA_LOCAL_DATACENTER:datacenter1}"
197 - # Enable/disable secure connection  
198 - ssl: "${CASSANDRA_USE_SSL:false}" 197 + ssl:
  198 + # Enable/disable secure connection
  199 + enabled: "${CASSANDRA_USE_SSL:false}"
  200 + # Enable/disable validation of Cassandra server hostname
  201 + # If enabled, hostname of Cassandra server must match CN of server certificate
  202 + hostname_validation: "${CASSANDRA_SSL_HOSTNAME_VALIDATION:true}"
  203 + # Set trust store for client authentication of server (optional, uses trust store from default SSLContext if not set)
  204 + trust_store: "${CASSANDRA_SSL_TRUST_STORE:}"
  205 + trust_store_password: "${CASSANDRA_SSL_TRUST_STORE_PASSWORD:}"
  206 + # Set key store for server authentication of client (optional, uses key store from default SSLContext if not set)
  207 + # A key store is only needed if the Cassandra server requires client authentication
  208 + key_store: "${CASSANDRA_SSL_KEY_STORE:}"
  209 + key_store_password: "${CASSANDRA_SSL_KEY_STORE_PASSWORD:}"
  210 + # Comma separated list of cipher suites (optional, uses Java default cipher suites if not set)
  211 + cipher_suites: "${CASSANDRA_SSL_CIPHER_SUITES:}"
199 # Enable/disable JMX 212 # Enable/disable JMX
200 jmx: "${CASSANDRA_USE_JMX:false}" 213 jmx: "${CASSANDRA_USE_JMX:false}"
201 # Enable/disable metrics collection. 214 # Enable/disable metrics collection.
@@ -797,4 +810,4 @@ management: @@ -797,4 +810,4 @@ management:
797 web: 810 web:
798 exposure: 811 exposure:
799 # Expose metrics endpoint (use value 'prometheus' to enable prometheus metrics). 812 # Expose metrics endpoint (use value 'prometheus' to enable prometheus metrics).
800 - include: '${METRICS_ENDPOINTS_EXPOSE:info}'  
  813 + include: '${METRICS_ENDPOINTS_EXPOSE:info}'
@@ -80,8 +80,22 @@ public class CassandraDriverOptions { @@ -80,8 +80,22 @@ public class CassandraDriverOptions {
80 80
81 @Value("${cassandra.compression}") 81 @Value("${cassandra.compression}")
82 private String compression; 82 private String compression;
83 - @Value("${cassandra.ssl}") 83 +
  84 + @Value("${cassandra.ssl.enabled}")
84 private Boolean ssl; 85 private Boolean ssl;
  86 + @Value("${cassandra.ssl.key_store}")
  87 + private String sslKeyStore;
  88 + @Value("${cassandra.ssl.key_store_password}")
  89 + private String sslKeyStorePassword;
  90 + @Value("${cassandra.ssl.trust_store}")
  91 + private String sslTrustStore;
  92 + @Value("${cassandra.ssl.trust_store_password}")
  93 + private String sslTrustStorePassword;
  94 + @Value("${cassandra.ssl.hostname_validation}")
  95 + private Boolean sslHostnameValidation;
  96 + @Value("${cassandra.ssl.cipher_suites}")
  97 + private List<String> sslCipherSuites;
  98 +
85 @Value("${cassandra.metrics}") 99 @Value("${cassandra.metrics}")
86 private Boolean metrics; 100 private Boolean metrics;
87 101
@@ -120,7 +134,19 @@ public class CassandraDriverOptions { @@ -120,7 +134,19 @@ public class CassandraDriverOptions {
120 134
121 if (this.ssl) { 135 if (this.ssl) {
122 driverConfigBuilder.withString(DefaultDriverOption.SSL_ENGINE_FACTORY_CLASS, 136 driverConfigBuilder.withString(DefaultDriverOption.SSL_ENGINE_FACTORY_CLASS,
123 - "DefaultSslEngineFactory"); 137 + "DefaultSslEngineFactory")
  138 + .withBoolean(DefaultDriverOption.SSL_HOSTNAME_VALIDATION, this.sslHostnameValidation);
  139 + if(!this.sslTrustStore.isEmpty()) {
  140 + driverConfigBuilder.withString(DefaultDriverOption.SSL_TRUSTSTORE_PATH, this.sslTrustStore)
  141 + .withString(DefaultDriverOption.SSL_TRUSTSTORE_PASSWORD, this.sslTrustStorePassword);
  142 + }
  143 + if(!this.sslKeyStore.isEmpty()) {
  144 + driverConfigBuilder.withString(DefaultDriverOption.SSL_KEYSTORE_PATH, this.sslKeyStore)
  145 + .withString(DefaultDriverOption.SSL_KEYSTORE_PASSWORD, this.sslKeyStorePassword);
  146 + }
  147 + if(!this.sslCipherSuites.isEmpty()) {
  148 + driverConfigBuilder.withStringList(DefaultDriverOption.SSL_CIPHER_SUITES, this.sslCipherSuites);
  149 + }
124 } 150 }
125 151
126 if (this.metrics) { 152 if (this.metrics) {
@@ -6,7 +6,13 @@ cassandra.url=127.0.0.1:9142 @@ -6,7 +6,13 @@ cassandra.url=127.0.0.1:9142
6 6
7 cassandra.local_datacenter=datacenter1 7 cassandra.local_datacenter=datacenter1
8 8
9 -cassandra.ssl=false 9 +cassandra.ssl.enabled=false
  10 +cassandra.ssl.hostname_validation=false
  11 +cassandra.ssl.trust_store=
  12 +cassandra.ssl.trust_store_password=
  13 +cassandra.ssl.key_store=
  14 +cassandra.ssl.key_store_password=
  15 +cassandra.ssl.cipher_suites=
10 16
11 cassandra.jmx=false 17 cassandra.jmx=false
12 18