Skip to content

STORM-4079: Add SSL setup documentation #8428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rzo1 merged 5 commits into from
Mar 19, 2026
+13 −1
Merged

STORM-4079: Add SSL setup documentation #8428

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c03a3e5
STORM-4079: Add SSL setup documentation
MNkulkarni06 Mar 16, 2026
8981b71
STORM-3879: Add Kafka monitor README to distribution
MNkulkarni06 Mar 16, 2026
c5e0d90
STORM-4079: Remove incorrect SSL setup section and keep valid configu…
MNkulkarni06 Mar 17, 2026
4ab859a
Remove incorrect SSL section and update TLS docs
MNkulkarni06 Mar 18, 2026
d69cecf
Improve docs: add overview for TLS configuration
MNkulkarni06 Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,9 +128,11 @@ UI,DRPC and LOGVIEWER allows users to configure ssl .

### UI

These configurations enable HTTPS for the Storm UI, allowing secure communication between users and the cluster.

For UI users needs to set following config in storm.yaml. Generating keystores with proper keys and certs should be taken care by the user before this step.

1. ui.https.port
1. ui.https.port (Port for HTTPS UI access)
Copy link
Contributor

@rzo1 rzo1 Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this change can be removed since it is obvious.

2. ui.https.keystore.type (example "jks")
3. ui.https.keystore.path (example "/etc/ssl/storm_keystore.jks")
4. ui.https.keystore.password (keystore password)
Expand Down Expand Up @@ -193,6 +195,14 @@ If users want to setup 2-way auth

Storm now supports mutual TLS (mTLS) for internal Thrift RPC communication among Nimbus, Supervisors, and workers. Unlike one-way TLS, mTLS requires both parties to present and verify each other's certificates. This ensures full two-way certificate authentication and encryption.

### Overview of TLS Configuration

Storm provides TLS support for securing internal communication between Nimbus, Supervisors, and workers. This is achieved using existing configuration properties for Thrift-based RPC communication and Netty-based messaging.

The TLS setup requires configuring keystore and truststore paths along with enabling TLS flags for each component. Nimbus and Supervisors use Thrift TLS settings, while workers use Netty TLS settings.

The following sections provide example configurations for each component.

### Example TLS Configuration

### 1. Nimbus Settings
Expand Down Expand Up @@ -682,3 +692,5 @@ Also, there are several configurations for topology Zookeeper authentication:
| storm.zookeeper.topology.auth.payload | A string representing the payload for topology Zookeeper authentication. |

Note: If storm.zookeeper.topology.auth.payload isn't set, Storm will generate a ZooKeeper secret payload for MD5-digest with generateZookeeperDigestSecretPayload() method.