HTTPS

Overview

HTTPS encrypts request headers, which matters most when those headers carry credentials. Any deployment using OAuth or local users and groups should enable it, since both put a token or a password in a header on every request.

The ingress terminates TLS for clients outside the cluster. Enabling HTTPS on the server itself also encrypts the traffic from the ingress and from in-cluster callers to the server, which encryption-in-transit requirements usually call for.

A server instance serves one protocol. Enabling HTTPS stops the plain HTTP listener rather than adding to it, so clients configured against the HTTP port need updating at the same time.

Configuration

The Gravitino server and the Iceberg REST service are configured separately with the same property names under different prefixes. Use gravitino.server.webserver. for the Gravitino server and gravitino.iceberg-rest. for the Iceberg REST service. None of them has a dedicated chart value, so set them under gravitino.additionalConfigItems in my-values.yaml as quoted strings; see Set other server properties.

Property Name	Description	Default Value	Required
enableHttps	Enables HTTPS	false	No
httpsPort	HTTPS port for the Jetty web server	8433 and 9433	No
keyStorePath	Path to the key store file	(none)	Yes
keyStorePassword	Password for the key store	(none)	Yes
managerPassword	Manager password for the key store	(none)	Yes
keyStoreType	Key store type	JKS	No
tlsProtocol	TLS protocol to use, which the JVM must support	(none)	No
enableCipherAlgorithms	Cipher algorithms to enable	(empty)	No
enableClientAuth	Requires clients to authenticate with a certificate	false	No
trustStorePath	Path to the trust store file	(none)	Yes with client authentication
trustStorePassword	Password for the trust store	(none)	Yes with client authentication
trustStoreType	Trust store type	JKS	No

The default HTTPS port is 8433 for the Gravitino server and 9433 for the Iceberg REST service. Everything in the Required column applies once enableHttps is true.

For the values tlsProtocol and enableCipherAlgorithms accept, see the "Additional JSSE Standard Names" section of the Java security guide, under protocols and cipher suites respectively.

Enable HTTPS on the server

The steps run against an install made with Install with Helm, and use the NAMESPACE and RELEASE variables set in its install step 1. They serve the server on 8433 with a key store held in a Kubernetes Secret.

1. Create a key store. Use a certificate issued for the host name clients reach the server by. For a test, a self-signed key pair works:

   Generate a key store

   keytool -genkeypair -alias gravitino \
     -keyalg RSA -keysize 4096 -sigalg SHA256withRSA \
     -keystore gravitino.jks -storetype JKS \
     -storepass {store_password} -keypass {key_password} \
     -dname "cn={server_host}" -validity 365

2. Store it in a Secret.

   Create the key store Secret

   kubectl -n "$NAMESPACE" create secret generic gravitino-keystore \
     --from-file=gravitino.jks

3. Mount the key store and turn on HTTPS. Add the following to your values file:

   my-values.yaml

   gravitino:
     extraVolumes:
       - name: gravitino-keystore
         secret:
           secretName: gravitino-keystore
     extraVolumeMounts:
       - name: gravitino-keystore
         mountPath: /opt/gravitino/tls
         readOnly: true
     additionalConfigItems:
       gravitino.server.webserver.enableHttps: "true"
       gravitino.server.webserver.httpsPort: "8433"
       gravitino.server.webserver.keyStorePath: "/opt/gravitino/tls/gravitino.jks"
       gravitino.server.webserver.keyStorePassword: "{store_password}"
       gravitino.server.webserver.managerPassword: "{key_password}"

4. Apply the change by re-running the helm upgrade --install command from install step 7. The server restarts on 8433, and its probes, Service and in-cluster callers follow it to HTTPS.

5. Connect. Export the certificate so a client can trust it, forward the port, and call the server:

   Call the server over HTTPS

   keytool -exportcert -rfc -alias gravitino -keystore gravitino.jks \
     -storepass {store_password} -file gravitino.pem
   kubectl -n "$NAMESPACE" port-forward "svc/$RELEASE-gravitino" 8433:8433 &
   curl --cacert gravitino.pem --resolve {server_host}:8433:127.0.0.1 \
     -H "Accept: application/vnd.gravitino.v1+json" \
     https://{server_host}:8433/api/version

   --resolve sends the certificate's host name through the port forward. A 401 is the expected answer to an unauthenticated call. A Java client takes the HTTPS URI directly once its JVM trusts the certificate:

   Main.java

   import org.apache.gravitino.client.GravitinoClient;
   import org.apache.gravitino.client.GravitinoVersion;
   
   public class Main {
       public static void main(String[] args) {
           String uri = "https://{server_host}:8433";
           GravitinoClient client = GravitinoClient.builder(uri).withMetalake("metalake").build();
           GravitinoVersion gravitinoVersion = client.getVersion();
           System.out.println(gravitinoVersion);
       }
   }

Related

• Install with Helm for the ingress, which terminates TLS for external clients
• Configurations for the rest of the web server settings
• How to Authenticate for the authentication methods HTTPS protects