Pulsar PubSub: allow TLS configuration for hostname and insecure connections

pubsub/pulsar/metadata.go

@@ -20,21 +20,23 @@ import (
 )
 
 type pulsarMetadata struct {
-	Host                    string                    `mapstructure:"host"`
-	ConsumerID              string                    `mapstructure:"consumerID"`
-	EnableTLS               bool                      `mapstructure:"enableTLS"`
-	DisableBatching         bool                      `mapstructure:"disableBatching"`
-	BatchingMaxPublishDelay time.Duration             `mapstructure:"batchingMaxPublishDelay"`
-	BatchingMaxSize         uint                      `mapstructure:"batchingMaxSize"`
-	BatchingMaxMessages     uint                      `mapstructure:"batchingMaxMessages"`
-	Tenant                  string                    `mapstructure:"tenant"`
-	Namespace               string                    `mapstructure:"namespace"`
-	Persistent              bool                      `mapstructure:"persistent"`
-	RedeliveryDelay         time.Duration             `mapstructure:"redeliveryDelay"`
-	internalTopicSchemas    map[string]schemaMetadata `mapstructure:"-"`
-	PublicKey               string                    `mapstructure:"publicKey"`
-	PrivateKey              string                    `mapstructure:"privateKey"`
-	Keys                    string                    `mapstructure:"keys"`
+	Host                       string                    `mapstructure:"host"`
+	ConsumerID                 string                    `mapstructure:"consumerID"`
+	EnableTLS                  bool                      `mapstructure:"enableTLS"`
+	DisableBatching            bool                      `mapstructure:"disableBatching"`
+	BatchingMaxPublishDelay    time.Duration             `mapstructure:"batchingMaxPublishDelay"`
+	BatchingMaxSize            uint                      `mapstructure:"batchingMaxSize"`
+	BatchingMaxMessages        uint                      `mapstructure:"batchingMaxMessages"`
+	Tenant                     string                    `mapstructure:"tenant"`
+	Namespace                  string                    `mapstructure:"namespace"`
+	Persistent                 bool                      `mapstructure:"persistent"`
+	RedeliveryDelay            time.Duration             `mapstructure:"redeliveryDelay"`
+	internalTopicSchemas       map[string]schemaMetadata `mapstructure:"-"`
+	PublicKey                  string                    `mapstructure:"publicKey"`
+	PrivateKey                 string                    `mapstructure:"privateKey"`
+	Keys                       string                    `mapstructure:"keys"`
+	TLSAllowInsecureConnection bool                      `mapstructure:"tlsAllowInsecureConnection"`
+	TLSValidateHostname        bool                      `mapstructure:"tlsValidateHostname"`
 
 	Token                            string `mapstructure:"token"`
 	oauth2.ClientCredentialsMetadata `mapstructure:",squash"`

pubsub/pulsar/metadata.yaml

@@ -57,7 +57,7 @@ metadata:
     sensitive: true
     description: "Address of the Pulsar broker."
     example: |
-      "localhost:6650", "http://pulsar-pj54qwwdpz4b-pulsar.ap-sg.public.pulsar.com:8080"
+      "localhost:6650", "http://pulsar-pj54qwwdpz4b-pulsar.ap-sg.public.pulsar.com:8080", "pulsar+ssl://localhost:6651"
   - name: consumerID
     type: string
     description: "Used to set the subscription name or consumer ID."
@@ -74,6 +74,18 @@ metadata:
       Enable TLS.
     default: 'false'
     example: '"true", "false"'
+  - name: tlsAllowInsecureConnection
+    type: bool
+    description: |
+      Allow insecure TLS connections
+    default: 'false'
+    example: '"true", "false"'
+  - name: tlsValidateHostname
+    type: bool
+    description: |
+      Validate hostname when using TLS
+    default: 'false'
+    example: '"true", "false"'
   - name: tenant
     description: |
       The topic tenant within the instance. Tenants are essential to multi-tenancy in Pulsar, and spread

pubsub/pulsar/pulsar.go

@@ -38,29 +38,34 @@ import (
 )
 
 const (
-	host                    = "host"
-	consumerID              = "consumerID"
-	enableTLS               = "enableTLS"
-	deliverAt               = "deliverAt"
-	deliverAfter            = "deliverAfter"
-	disableBatching         = "disableBatching"
-	batchingMaxPublishDelay = "batchingMaxPublishDelay"
-	batchingMaxSize         = "batchingMaxSize"
-	batchingMaxMessages     = "batchingMaxMessages"
-	tenant                  = "tenant"
-	namespace               = "namespace"
-	persistent              = "persistent"
-	redeliveryDelay         = "redeliveryDelay"
-	avroProtocol            = "avro"
-	jsonProtocol            = "json"
-	protoProtocol           = "proto"
-	partitionKey            = "partitionKey"
-
-	defaultTenant     = "public"
-	defaultNamespace  = "default"
-	cachedNumProducer = 10
-	pulsarPrefix      = "pulsar://"
-	pulsarToken       = "token"
+	host                       = "host"
+	consumerID                 = "consumerID"
+	enableTLS                  = "enableTLS"
+	deliverAt                  = "deliverAt"
+	deliverAfter               = "deliverAfter"
+	disableBatching            = "disableBatching"
+	batchingMaxPublishDelay    = "batchingMaxPublishDelay"
+	batchingMaxSize            = "batchingMaxSize"
+	batchingMaxMessages        = "batchingMaxMessages"
+	tenant                     = "tenant"
+	namespace                  = "namespace"
+	persistent                 = "persistent"
+	redeliveryDelay            = "redeliveryDelay"
+	avroProtocol               = "avro"
+	jsonProtocol               = "json"
+	protoProtocol              = "proto"
+	partitionKey               = "partitionKey"
+	tlsAllowInsecureConnection = "tlsAllowInsecureConnection"
+	tlsValidateHostname        = "tlsValidateHostname"
+
+	defaultTenant                     = "public"
+	defaultNamespace                  = "default"
+	defaultTLSAllowInsecureConnection = false
+	defaultTLSValidateHostname        = false
+	cachedNumProducer                 = 10
+	pulsarPrefix                      = "pulsar://"
+	pulsarSSLPrefix                   = "pulsar+ssl://"
+	pulsarToken                       = "token"
 	// topicFormat is the format for pulsar, which have a well-defined structure: {persistent|non-persistent}://tenant/namespace/topic,
 	// see https://pulsar.apache.org/docs/en/concepts-messaging/#topics for details.
 	topicFormat                = "%s://%s/%s/%s"
@@ -113,15 +118,17 @@ func NewPulsar(l logger.Logger) pubsub.PubSub {
 
 func parsePulsarMetadata(meta pubsub.Metadata) (*pulsarMetadata, error) {
 	m := pulsarMetadata{
-		Persistent:              true,
-		Tenant:                  defaultTenant,
-		Namespace:               defaultNamespace,
-		internalTopicSchemas:    map[string]schemaMetadata{},
-		DisableBatching:         false,
-		BatchingMaxPublishDelay: defaultBatchingMaxPublishDelay,
-		BatchingMaxMessages:     defaultMaxMessages,
-		BatchingMaxSize:         defaultMaxBatchSize,
-		RedeliveryDelay:         defaultRedeliveryDelay,
+		Persistent:                 true,
+		Tenant:                     defaultTenant,
+		Namespace:                  defaultNamespace,
+		internalTopicSchemas:       map[string]schemaMetadata{},
+		DisableBatching:            false,
+		BatchingMaxPublishDelay:    defaultBatchingMaxPublishDelay,
+		BatchingMaxMessages:        defaultMaxMessages,
+		BatchingMaxSize:            defaultMaxBatchSize,
+		RedeliveryDelay:            defaultRedeliveryDelay,
+		TLSAllowInsecureConnection: defaultTLSAllowInsecureConnection,
+		TLSValidateHostname:        defaultTLSValidateHostname,
 	}
 
 	if err := kitmd.DecodeMetadata(meta.Properties, &m); err != nil {
@@ -132,6 +139,11 @@ func parsePulsarMetadata(meta pubsub.Metadata) (*pulsarMetadata, error) {
 		return nil, errors.New("pulsar error: missing pulsar host")
 	}
 
+	// If tls is disabled allow insecure connections
+	if !m.EnableTLS {
+		m.TLSAllowInsecureConnection = true
+	}
+
 	for k, v := range meta.Properties {
 		switch {
 		case strings.HasSuffix(k, topicJSONSchemaIdentifier):
@@ -163,16 +175,13 @@ func (p *Pulsar) Init(ctx context.Context, metadata pubsub.Metadata) error {
 	if err != nil {
 		return err
 	}
-	pulsarURL := m.Host
-	if !strings.HasPrefix(m.Host, "http://") &&
-		!strings.HasPrefix(m.Host, "https://") {
-		pulsarURL = fmt.Sprintf("%s%s", pulsarPrefix, m.Host)
-	}
+	pulsarURL := getPulsarURL(m)
 	options := pulsar.ClientOptions{
 		URL:                        pulsarURL,
 		OperationTimeout:           30 * time.Second,
 		ConnectionTimeout:          30 * time.Second,
-		TLSAllowInsecureConnection: !m.EnableTLS,
+		TLSAllowInsecureConnection: m.TLSAllowInsecureConnection,
+		TLSValidateHostname:        m.TLSValidateHostname,
 	}
 
 	switch {
@@ -538,3 +547,18 @@ func isValidPEM(val string) bool {
 	block, _ := pem.Decode([]byte(val))
 	return block != nil
 }
+
+func getPulsarURL(m *pulsarMetadata) string {
+	pulsarURL := m.Host
+	if !strings.HasPrefix(m.Host, "http://") &&
+		!strings.HasPrefix(m.Host, "https://") &&
+		!strings.HasPrefix(m.Host, "pulsar+ssl://") &&
+		!strings.HasPrefix(m.Host, "pulsar://") {
+		if m.EnableTLS {
+			pulsarURL = fmt.Sprintf("%s%s", pulsarSSLPrefix, m.Host)
+		} else {
+			pulsarURL = fmt.Sprintf("%s%s", pulsarPrefix, m.Host)
+		}
+	}
+	return pulsarURL
+}

pubsub/pulsar/pulsar_test.go

@@ -46,6 +46,8 @@ func TestParsePulsarMetadata(t *testing.T) {
 	assert.Equal(t, uint(100), meta.BatchingMaxSize)
 	assert.Equal(t, uint(200), meta.BatchingMaxMessages)
 	assert.Empty(t, meta.internalTopicSchemas)
+	assert.True(t, meta.TLSAllowInsecureConnection)
+	assert.False(t, meta.TLSValidateHostname)
 }
 
 func TestParsePulsarSchemaMetadata(t *testing.T) {

tests/certification/pubsub/pulsar/certificates/broker.cert.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDizCCAnOgAwIBAgIUS8SLRMSCGbtimG179NI9aQcx3xwwDQYJKoZIhvcNAQEL
+BQAwETEPMA0GA1UEAwwGQ0FSb290MB4XDTIzMTIxOTE0MTQxNVoXDTI0MTIxODE0
+MTQxNVowETEPMA0GA1UEAwwGYnJva2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEA1QGJ1pDqDgZfuEU8HZnYQjqf8Twqv39VfJJ/t+krDXhsuYxT8TL9
+hKBGmuUDF83oTXN3BsTBFmRk449voSisCZnanOtrFlN9XUCMQQQII+oKLhQl0VqA
+ecSgc0m4PEzqpzReTazrBW7azhXDq87yVjgKpKXmTomIFrwb1ZpJMnF8+m8RwhJ5
+/VntY72lRkwelXf6IOkUi/RmkIcoaQlmo6ByxwfMxxsUtyWx87zJfPGmBSadjvPs
+tZQ3G54NkpO9KspgPRKYwzJSXz+8gucFuLjWlbtq4z68ld0D5m7Ll5u2N+MIMxdb
+IYTdk6A+JSC9NQ/xrM5RVGKYw/jtz3W14wIDAQABo4HaMIHXMEwGA1UdIwRFMEOA
+FKM79AteKYIUmajYKQErI13YwkfqoRWkEzARMQ8wDQYDVQQDDAZDQVJvb3SCFDR+
+svtJXHNhHTxYynzmk431ctXqMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWgMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDgGA1UdEQQxMC+CBnB1bHNhcoIOcHVsc2FyLmRl
+ZmF1bHSCCWxvY2FsaG9zdIcEfwAAAYcEwKgBAjAdBgNVHQ4EFgQU4uaxoAnAsCN9
+PmCy0n+sud5NcdMwDQYJKoZIhvcNAQELBQADggEBAJoCOY+BDWIznu/Ns5z1CaEa
++E78NEZ1NmeEYGttaO1UwsKE2GvA9fCuD/ODQk4db99cs8YU9Givsy2GK1qOicW6
+8EFda79qtICl9OGYfaWSUi35EsuNnAH0O/rkvvNtcAzIadbMgKTDKxR3mKE1XFY+
+AXFegwc/yliJQMzxMLWcPHp60paWZQEJCYshLO6basbUELHsrfx/dbugPPsJMwKS
+ThZu+ZwjLmk/r88UgTGRPF9r6osDOEKoCCrA3Y1uZiKzF12WzwzpcizykIjpNtAi
+kv3lryJpf6ANWna9xyD67DZTqRJExdiVvkLrwyRcQ9XrAZq9WJjB4+jdc2FjoG0=
+-----END CERTIFICATE-----

tests/certification/pubsub/pulsar/certificates/broker.key-pk8.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDVAYnWkOoOBl+4
+RTwdmdhCOp/xPCq/f1V8kn+36SsNeGy5jFPxMv2EoEaa5QMXzehNc3cGxMEWZGTj
+j2+hKKwJmdqc62sWU31dQIxBBAgj6gouFCXRWoB5xKBzSbg8TOqnNF5NrOsFbtrO
+FcOrzvJWOAqkpeZOiYgWvBvVmkkycXz6bxHCEnn9We1jvaVGTB6Vd/og6RSL9GaQ
+hyhpCWajoHLHB8zHGxS3JbHzvMl88aYFJp2O8+y1lDcbng2Sk70qymA9EpjDMlJf
+P7yC5wW4uNaVu2rjPryV3QPmbsuXm7Y34wgzF1shhN2ToD4lIL01D/GszlFUYpjD
++O3PdbXjAgMBAAECggEATzvvxK+KSSZI0/h5KL+yKMy681cAxdQ9fgXW2Zg0KiIa
+O5k+HnJryLqAGR1IXcH8AFeLtqpY8xXsS5PvH+FLwZSINCgEYT00XIxmv8aaqpVk
+LQjUmoBSWzlvwALztAaeoQ0DaVyB3jcC0HdbHp1wGu9k0iNePOe/Bkn6BqaKROcx
+re8PrBz7J++49Xn1S0eX8GVt5TXhdS6c7u6qi+hxnu/vJ/RkYBUpEIUXd6jOrV/D
+nJegDuLLTDIsh4+CL1D9djvYRmMIjItr+17gm35C4emZWvtt8Aa+s+vYdwDfqaLx
+A7FOVswFxqwtzfrqWh9Mum4EoIcinl56C5fRJ9UFmQKBgQDqLNX7uF2yyo5yEY81
+hEa2Y2b3L6VciX/FjMrGLs5UR5jnoLOSGpCvbtHiNUUXoz+XHEX4J3z8YC3Ld1CV
+sENYj2bAZ0wHqTBl1LI0l2utv+auFwT9WG1UlPxxrf92sQabxdiv5MXKysirDbrI
+1yS0Ulxbm7jtbDKu+s+zc8FRWwKBgQDo26FQAy2bDt88PTTW4DJ0SaMwOg4RLxQ+
+ahlgQ1MjzDjgZKmsPkC9W7XwUibKgpxjs7PzuI4o8zyLjquHaAxj9s2JtPeUxrFD
+3WxlJEc1Cyqdw8EKQVcWaendpVfRarisjkY+HX7SloIvPApCzKWLWSf1U5rgzna9
+DkkjV/WMGQKBgQC+rOFTxIwuz7Xq9ZdJOTqmuguWDCq2TZNHVNurQWNpxp6fQ//T
+YGQdJLwrV7q5g4h8z129sNGZYesH+FAaglpj2ugMlE+ZEU9CK00re3wHDvGTIVVD
+wGPNcj6Xhdk0WPKLli5ZEotnE3UPqu9DJ8NQPJvNT9/lGquuRLUoZoGrbwKBgCtX
+JbEkxkpD/FzT74/G7t0iD5OcWp3sK1JqoQp/vWu+SR/K3KHIfHhCJ5zxTXMH2F/e
+RLIqOZt5ml1HUrnDLfs1JpBo9GPmj3vYLKKum+pNh8MRek6UVsc/M14jtjKuMG09
+leldyAseJGDyRd6lBHLpRzysMPmCtCsAC7DeYD+RAoGBAN0ZlKyM0urieZBdvskz
+JG3RyDCWVm9i6LPfDO8c44yE5RzzFmFfM/mLSdygy0z1oXu8EYsl3+1cdp/UimzK
+F2P8vu3SN0xIJi8aARyxKZT91odl8EWZQDN9jEvDER0C++MYC1Z4uCr6fMcjEXqW
+CGRchBTSfc/TSREY//0O787B
+-----END PRIVATE KEY-----

tests/certification/pubsub/pulsar/certificates/ca.cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDAzCCAeugAwIBAgIUNH6y+0lcc2EdPFjKfOaTjfVy1eowDQYJKoZIhvcNAQEL
+BQAwETEPMA0GA1UEAwwGQ0FSb290MB4XDTIzMTIxOTEzMjcwM1oXDTI0MTIxODEz
+MjcwM1owETEPMA0GA1UEAwwGQ0FSb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAvQw5BVp88Z7e1bBOgYY7tWSdJYyKV2VwOUnrOn0oTRphdhuyT7Nc
+AA98L3UACO+bq46TacFH7opMKFA5W15rpE5A4KZ5zhcydzpWl/r+LyRuKf2q86uU
+Ke7xbUhWoy/DdGKBTE2vsUHmrJ0u+ffLg1aS4hjGW97ILAwjhT3/bunqrG3bH0Mq
+cTBM68kMIFitLJMu1aOCNWDMXUPXZ74SEn2TgNdHsm5RfuAIMloa8RB0bsF4/OMp
+esctCxh9BbKpIkxRPO4mdeWyahMjCr48/+dUrpwX39Uz27GOWBNWrAx4KCrNFFnQ
+G9me6+x5UamQ1vAKO9dhqTVsUAj+r8SLEQIDAQABo1MwUTAdBgNVHQ4EFgQUozv0
+C14pghSZqNgpASsjXdjCR+owHwYDVR0jBBgwFoAUozv0C14pghSZqNgpASsjXdjC
+R+owDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEANpZN716EiZUN
+vS7Se57qhi25jopy+10xI68nB2GjuO5o+mtTPp87fT53GB3EtZzqV2bsYMNQNO1U
+HzPurRlU/nBxRWmwavFwJJbBhE8YOVZGtyYW0H/x6Jn0K15D0o3O93aMLNMZltYw
+2BPL+X0jyoXjJxKRWgrxbpVTOsM6PJ0MH3qrZnC1msijU00nxVEeaY2rARfMqKEV
+F8s2x6+liNIXtmg60ecB3woBSbDKAQNQvxu42s9APb8dQcZK8Pb8ujEs81GGKpVl
+K5W9RlrcGqgQIWoSfwFkabvS8ct0hrcOjUReih7cHAh4Pc6fnUGlND0brPXr5c6n
+JZU1vhteXA==
+-----END CERTIFICATE-----

tests/certification/pubsub/pulsar/components/tls/consumer_five/pulsar.yaml

@@ -0,0 +1,26 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: messagebus
+spec:
+  type: pubsub.pulsar
+  version: v1
+  metadata:
+  - name: host
+    value: "localhost:6651"
+  - name: consumerID
+    value: certification5
+  - name: redeliveryDelay
+    value: 200ms
+  - name: publicKey
+    value: public.key
+  - name: privateKey
+    value: private.key
+  - name: keys
+    value: myapp.key
+  - name: tlsAllowInsecureConnection
+    value: true
+  - name: tlsValidateHostname
+    value: false
+  - name: enableTLS
+    value: true

tests/certification/pubsub/pulsar/components/tls/consumer_four/pulsar.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: messagebus
+spec:
+  type: pubsub.pulsar
+  version: v1
+  metadata:
+  - name: host
+    value: "localhost:6651"
+  - name: consumerID
+    value: certification4
+  - name: redeliveryDelay
+    value: 200ms
+  - name: certification-pubsub-topic-active.jsonschema
+    value: "{\"type\":\"record\",\"name\":\"Example\",\"namespace\":\"test\",\"fields\":[{\"name\":\"ID\",\"type\":\"int\"},{\"name\":\"Name\",\"type\":\"string\"}]}"
+  - name: tlsAllowInsecureConnection
+    value: true
+  - name: tlsValidateHostname
+    value: false
+  - name: enableTLS
+    value: true

tests/certification/pubsub/pulsar/components/tls/consumer_one/pulsar.yml

@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: messagebus
+spec:
+  type: pubsub.pulsar
+  version: v1
+  metadata:
+  - name: host
+    value: "localhost:6651"
+  - name: consumerID
+    value: certification1
+  - name: redeliveryDelay
+    value: 200ms
+  - name: tlsAllowInsecureConnection
+    value: true
+  - name: tlsValidateHostname
+    value: false
+  - name: enableTLS
+    value: true

tests/certification/pubsub/pulsar/components/tls/consumer_six/pulsar.yaml

@@ -0,0 +1,26 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: messagebus
+spec:
+  type: pubsub.pulsar
+  version: v1
+  metadata:
+  - name: host
+    value: "localhost:6651"
+  - name: consumerID
+    value: certification5
+  - name: redeliveryDelay
+    value: 200ms
+  - name: publicKey
+    value: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1KDAM4L8RtJ+nLaXBrBh\nzVpvTemsKVZoAct8A+ShepOHT9lgHOCGLFGWNla6K6j+b3AV/P/fAAhwj82vwTDd\nruXSflvSdmYeFAw3Ypphc1A5oM53wSRWhg63potBNWqdDzj8ApYgqjpmjYSQdL5/\na3golb36GYFrY0MLFTv7wZ87pmMIPsOgGIcPbCHker2fRZ34WXYLb1hkeUpwx4eK\njpwcg35gccvR6o/UhbKAuc60V1J9Wof2sNgtlRaQej45wnpjWYzZrIyk5qUbn0Qi\nCdpIrXvYtANq0Id6gP8zJvUEdPIgNuYxEmVCl9jI+8eGI6peD0qIt8U80hf9axhJ\n3QIDAQAB\n-----END PUBLIC KEY-----\n"
+  - name: privateKey
+    value: "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1KDAM4L8RtJ+nLaXBrBhzVpvTemsKVZoAct8A+ShepOHT9lg\nHOCGLFGWNla6K6j+b3AV/P/fAAhwj82vwTDdruXSflvSdmYeFAw3Ypphc1A5oM53\nwSRWhg63potBNWqdDzj8ApYgqjpmjYSQdL5/a3golb36GYFrY0MLFTv7wZ87pmMI\nPsOgGIcPbCHker2fRZ34WXYLb1hkeUpwx4eKjpwcg35gccvR6o/UhbKAuc60V1J9\nWof2sNgtlRaQej45wnpjWYzZrIyk5qUbn0QiCdpIrXvYtANq0Id6gP8zJvUEdPIg\nNuYxEmVCl9jI+8eGI6peD0qIt8U80hf9axhJ3QIDAQABAoIBAQCKuHnM4ac/eXM7\nQPDVX1vfgyHc3hgBPCtNCHnXfGFRvFBqavKGxIElBvGOcBS0CWQ+Rg1Ca5kMx3TQ\njSweSYhH5A7pe3Sa5FK5V6MGxJvRhMSkQi/lJZUBjzaIBJA9jln7pXzdHx8ekE16\nBMPONr6g2dr4nuI9o67xKrtfViwRDGaG6eh7jIMlEqMMc6WqyhvI67rlVDSTHFKX\njlMcozJ3IT8BtTzKg2Tpy7ReVuJEpehum8yn1ZVdAnotBDJxI07DC1cbOP4M2fHM\ngfgPYWmchauZuTeTFu4hrlY5jg0/WLs6by8r/81+vX3QTNvejX9UdTHMSIfQdX82\nAfkCKUVhAoGBAOvGv+YXeTlPRcYC642x5iOyLQm+BiSX4jKtnyJiTU2s/qvvKkIu\nxAOk3OtniT9NaUAHEZE9tI71dDN6IgTLQlAcPCzkVh6Sc5eG0MObqOO7WOMCWBkI\nlaAKKBbd6cGDJkwGCJKnx0pxC9f8R4dw3fmXWgWAr8ENiekMuvjSfjZ5AoGBAObd\ns2L5uiUPTtpyh8WZ7rEvrun3djBhzi+d7rgxEGdditeiLQGKyZbDPMSMBuus/5wH\nwfi0xUq50RtYDbzQQdC3T/C20oHmZbjWK5mDaLRVzWS89YG/NT2Q8eZLBstKqxkx\ngoT77zoUDfRy+CWs1xvXzgxagD5Yg8/OrCuXOqWFAoGAPIw3r6ELknoXEvihASxU\nS4pwInZYIYGXpygLG8teyrnIVOMAWSqlT8JAsXtPNaBtjPHDwyazfZrvEmEk51JD\nX0tA8M5ah1NYt+r5JaKNxp3P/8wUT6lyszyoeubWJsnFRfSusuq/NRC+1+KDg/aq\nKnSBu7QGbm9JoT2RrmBv5RECgYBRn8Lj1I1muvHTNDkiuRj2VniOSirkUkA2/6y+\nPMKi+SS0tqcY63v4rNCYYTW1L7Yz8V44U5mJoQb4lvpMbolGhPljjxAAU3hVkItb\nvGVRlSCIZHKczADD4rJUDOS7DYxO3P1bjUN4kkyYx+lKUMDBHFzCa2D6Kgt4dobS\n5qYajQKBgQC7u7MFPkkEMqNqNGu5erytQkBq1v1Ipmf9rCi3iIj4XJLopxMgw0fx\n6jwcwNInl72KzoUBLnGQ9PKGVeBcgEgdI+a+tq+1TJo6Ta+hZSx+4AYiKY18eRKG\neNuER9NOcSVJ7Eqkcw4viCGyYDm2vgNV9HJ0VlAo3RDh8x5spEN+mg==\n-----END RSA PRIVATE KEY-----\n"
+  - name: keys
+    value: myapp.key
+  - name: tlsAllowInsecureConnection
+    value: true
+  - name: tlsValidateHostname
+    value: false
+  - name: enableTLS
+    value: true