nevzheng opened a new issue, #12298: URL: https://github.com/apache/gravitino/issues/12298
### Describe the subtask Before implementing TLS support on the Java client (see parent epic), we need a short design doc that pins down the **exact public API** — signatures, not sketches — so every subsequent PR is reviewed against an agreed design instead of debating it inline. ## Deliverable One page at `design-docs/gravitino-client-tls.md`. Its job is to let a reviewer answer three questions without opening a diff: **"What does a user write?"** Each CUJ from the epic, shown as the actual client code — a few lines each: 1. Private-CA server (custom truststore) 2. Mutual TLS (truststore + client keystore) 3. Client certificate with the system truststore 4. Restricting protocols / cipher suites If a journey can't be shown in a few lines, that's a design finding — this doc is where it surfaces, before implementation. **"What are we promising?"** The exact public surface: every new public type and method, with signatures, and — just as explicitly — what stays internal. This includes recording the builder-method decision (a narrow, typed `withTlsConfigurer(TLSConfigurer)` vs. a general hook over the underlying HTTP builder) with its rationale, so it is settled by reference and not re-argued per PR. Note the asymmetry: a narrow API can be widened in a later release; a general one can never be narrowed. **"What are we *not* doing?"** Non-goals, stated so scope questions in later PRs are answered by a link instead of a debate. ## Acceptance criteria - [ ] `design-docs/gravitino-client-tls.md` merged (doc-only PR) - [ ] All four CUJs shown as compilable-looking client code - [ ] Every new public type/method listed with its signature; internal types named as internal - [ ] The builder-method decision recorded with rationale - [ ] Non-goals stated Blocks the implementation subtasks of this epic; the server-side test subtask is independent and may proceed in parallel. ### Parent issue https://github.com/apache/gravitino/issues/9836 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
