Zoltan Chovan has posted comments on this change. ( http://gerrit.cloudera.org:8080/24383 )
Change subject: KUDU-3781: add TLS transport support for HMS client ...................................................................... Patch Set 5: (2 comments) http://gerrit.cloudera.org:8080/#/c/24383/5/src/kudu/hms/hms_catalog.cc File src/kudu/hms/hms_catalog.cc: http://gerrit.cloudera.org:8080/#/c/24383/5/src/kudu/hms/hms_catalog.cc@146 PS5, Line 146: "--hive_metastore_tls_use_https_trusted_ca_cert is set to '$1': " : "using $0 to load trusted CA certificates for TLS-protected " : "Hive Metastore Thrift connections", : use_https_ca_cert, ca_cert_flag); aren't the args reversed? this would say: "flag is set to 'CA flag name' and using 'true/false'" http://gerrit.cloudera.org:8080/#/c/24383/5/src/kudu/thrift/client.cc File src/kudu/thrift/client.cc: http://gerrit.cloudera.org:8080/#/c/24383/5/src/kudu/thrift/client.cc@89 PS5, Line 89: sf.authenticate(true); : if (!options.tls_trusted_ca_cert_file.empty()) { : sf.loadTrustedCertificates(options.tls_trusted_ca_cert_file.c_str()); : } What happens in a scenario, where enable_tls is true, sf.authenticate(true) is called, but the tls_trusted_ca_cert_file is empty? Will thrift load the system default cert paths? If not, couldn't that mean it's possible, that there are system wide trusted cert(s) present, that aren't loaded, but due to authenticate(true) would be expected, so the connection fails? So what I'm asking, is if we want to default to system-wide certs if the ca path here is empty. -- To view, visit http://gerrit.cloudera.org:8080/24383 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65 Gerrit-Change-Number: 24383 Gerrit-PatchSet: 5 Gerrit-Owner: Alexey Serbin <[email protected]> Gerrit-Reviewer: Abhishek Chennaka <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Reviewer: Zoltan Chovan <[email protected]> Gerrit-Comment-Date: Wed, 03 Jun 2026 08:25:58 +0000 Gerrit-HasComments: Yes
