Skip to content

Add support for disabling TLS #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 13, 2024
Merged

Add support for disabling TLS #150

merged 5 commits into from
Sep 13, 2024

Conversation

rohanshah18
Copy link
Contributor

@rohanshah18 rohanshah18 commented Sep 4, 2024

Problem

Add support for enabling/disabling TLS.

Solution

Added enableTls boolean flag which is set to true by default but when set to false, it will be disabled.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • Infrastructure change (CI configs, etc)
  • Non-code change (docs, etc)
  • None of the above: (explain here)

Test Plan

Since the flag is set to true by default, the existing integration tests should work as it is.

Copy link

@haruska haruska left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couple considerations:

  1. Is this TLS flag needed? In the example code:

* // Custom channel with timeouts
* try {
* builder = builder.overrideAuthority(endpoint)
* .negotiationType(NegotiationType.TLS)
* .keepAliveTimeout(5, TimeUnit.SECONDS)
* .sslContext(GrpcSslContexts.forClient().build());
* } catch (SSLException e) {
* throw new PineconeException("SSL error opening gRPC channel", e);
* }

It looks like you can set negotiationType(NegotiationType.PLAINTEXT) to turn off TLS?

  1. Is the flag really global to PineconeClient? Or is it per-connection to an index?
  2. Another example had the host with a http(s):// prefix and :PORT suffix. Would the http vs https prefix on the host be enough without setting a specific flag? Or is this considered bad practice?

@rohanshah18
Copy link
Contributor Author

Couple considerations:

  1. Is this TLS flag needed? In the example code:

* // Custom channel with timeouts
* try {
* builder = builder.overrideAuthority(endpoint)
* .negotiationType(NegotiationType.TLS)
* .keepAliveTimeout(5, TimeUnit.SECONDS)
* .sslContext(GrpcSslContexts.forClient().build());
* } catch (SSLException e) {
* throw new PineconeException("SSL error opening gRPC channel", e);
* }

It looks like you can set negotiationType(NegotiationType.PLAINTEXT) to turn off TLS?

  1. Is the flag really global to PineconeClient? Or is it per-connection to an index?
  2. Another example had the host with a http(s):// prefix and :PORT suffix. Would the http vs https prefix on the host be enough without setting a specific flag? Or is this considered bad practice?
  1. Yes, we set negotiationType(NegotiationType.PLAINTEXT) to turn off TLS. This is where the flag is used: https://github.com/pinecone-io/pinecone-java-client/pull/150/files#diff-b976ef187206eaaba2d35fc19f368cbc2674b74e86ac31b75e0e969378d4608dR142
    If I were to not use the flag, how can I know whether we want to turn on or off the TLS?
  2. We have a config object which is instantiated when a pinecone class is instantiated. And the same config object is further used for Index class which is responsible for gRPC index connections.
  3. I'm not sure if I understood pt#3 but I'll go ahead and explain how we handle the host. The flag is enabled by default so tls is enabled and hence when trying to establish gRPC connection, we actually format the host by ignoring http(s) here:
    public static String formatEndpoint(String host) {

Copy link
Contributor

@ssmith-pc ssmith-pc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks straightforward, few minor comments

@rohanshah18 rohanshah18 merged commit c75a0df into main Sep 13, 2024
7 checks passed
@rohanshah18 rohanshah18 deleted the rshah/pclocal branch September 13, 2024 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants