(storm) branch master updated: Hardening: scope Prometheus reporter insecure TLS to its own connection

[rzo1]

This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git


The following commit(s) were added to refs/heads/master by this push:
     new 7e79c5952 Hardening: scope Prometheus reporter insecure TLS to its own 
connection
7e79c5952 is described below

commit 7e79c59520665a5ea8fe7204042e4cd1ce95dd60
Author: Richard Zowalla <r...@apache.org>
AuthorDate: Tue Apr 14 13:09:23 2026 +0200

    Hardening: scope Prometheus reporter insecure TLS to its own connection
---
 .../storm/metrics/prometheus/PrometheusPreparableReporter.java       | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/external/storm-metrics-prometheus/src/main/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporter.java
 
b/external/storm-metrics-prometheus/src/main/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporter.java
index 21c0e34eb..d268528e6 100644
--- 
a/external/storm-metrics-prometheus/src/main/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporter.java
+++ 
b/external/storm-metrics-prometheus/src/main/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporter.java
@@ -56,9 +56,9 @@ public class PrometheusPreparableReporter implements 
PreparableReporter {
         try {
             final SSLContext sslContext = SSLContext.getInstance("TLS");
             sslContext.init(null, new TrustManager[]{INSECURE_TRUST_MANAGER}, 
null);
-            SSLContext.setDefault(sslContext);
 
             final HttpsURLConnection connection = (HttpsURLConnection) 
url.openConnection();
+            connection.setSSLSocketFactory(sslContext.getSocketFactory());
             connection.setHostnameVerifier((hostname, session) -> true);
             return connection;
         } catch (NoSuchAlgorithmException | KeyManagementException e) {
@@ -104,6 +104,9 @@ public class PrometheusPreparableReporter implements 
PreparableReporter {
             builder.scheme(scheme);
 
             if (scheme == Scheme.HTTPS && skipTlsValidation) {
+                LOG.warn("TLS validation is DISABLED for the Prometheus 
PushGateway connection "
+                        + 
"(storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation=true). "
+                        + "This is insecure and must not be used in 
production.");
                 builder.connectionFactory(INSECURE_CONNECTION_FACTORY);
             }