Updated ssl to true by default for core peer forwarder

[asifsmohammed]

Signed-off-by: Asif Sohail Mohammed nsifmoh@amazon.com

Description

• Server creation is moved from Spring configuration file to PeerForwarderServerProxy, so we don't need cert files for bean creation.
• Now demo certificates added by this PR can be used while running Data Prepper with Peer Forwarder.
• Peer forwarder can be started without configuring ssl, ssl_certificate_file, ssl_key_file and will use default certificates.
• Manually tested it locally to verify if the default certificates are working.

Issues Resolved

resolves #1699

Check List

• New functionality includes testing.
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed with a real name per the DCO

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[dlvenable]

From what I can tell, this turns on SSL, but there is no configured certificate/key pair. So I expect Data Prepper will fail to start.

[dlvenable]

I think we need to set this default value to the sample certificate. I believe it would be config/sample-certificate.pem or something similar.

[asifsmohammed]

Yeah, it fails if sample certificates in config directory are not used. I thought we just provide the sample certs and user has to configure it using them.
But I can update sslCertificateFile and sslKeyFile to default certs file paths.

[dlvenable]

I think it should be able to run by default. This is similar to how you can run OpenSearch by default with the default certificate.

[asifsmohammed]

Hey @dlvenable, I tried adding the default paths to these configurations but it's challenging as we don't know the path at compile time. Because the system property DATA_PREPPER_HOME is not set.
If we hardcode the system property DATA_PREPPER_HOME then it can be changed at runtime using '-Ddata-prepper.dir=/app/data-prepper'.

Let me know if you have any suggestions? I think we can just leave it like this and ask the user to use the default certificates provided in /config directory but it's an additional step if ssl is enabled.

public static final String DEFAULT_CERTIFICATE_FILE_PATH = "config/default_certificate.pem";
public static final String DEFAULT_PRIVATE_KEY_FILE_PATH = "config/default_private_key.pem";
private static final String DATA_PREPPER_HOME = System.getProperty("data-prepper.dir");
    
private boolean ssl = true;
private String sslCertificateFile = Paths.get(DATA_PREPPER_HOME).resolve(DEFAULT_CERTIFICATE_FILE_PATH).toString();
private String sslKeyFile = Paths.get(DATA_PREPPER_HOME).resolve(DEFAULT_PRIVATE_KEY_FILE_PATH).toString();

One alternative is to pass in third argument to the ContextManager and make necessary changes in DataPrepperArgs. This approach is easier to implement if Data Prepper is run without arguments as we create the arguments in this approach.

final String dataPrepperPipelines = Paths.get(dataPrepperHome).resolve("pipelines/").toString();
final String dataPrepperConfig = Paths.get(dataPrepperHome).resolve("config/data-prepper-config.yaml").toString();
final String defaultSslCertificateFile = Paths.get(dataPrepperHome).resolve("config/default_certificate.pem").toString();
final String defaultSslPrivateKeyFile = Paths.get(dataPrepperHome).resolve("config/default_private_key.pem").toString();
contextManager = new ContextManager(dataPrepperPipelines, dataPrepperConfig, defaultSslCertificateFile, defaultSslPrivateKeyFile);

If user passes pipeline and Data Prepper config YAML files it would't be possible as arguments size can be dynamic.

[dlvenable]

If we set the value to config/default-certificate would it not resolve correctly? It should resolve from the current directory which is the Data Prepper directory.

If this works for most scenarios, but not all, I'd be fine. We can improve it later.

[asifsmohammed]

I'll try a POC for this and update here.

[asifsmohammed]

I tried manual testing and config/defailt-cert-path works without configuring ssl, ssl_certificate_file, ssl_key_file.

[dlvenable]

This should also be set to the default key file.

[dlvenable]

Is this test still valid since the file doesn't exist? Or does the validation not yet happen?

[dlvenable]

Should this be removed? If so, let's remove the line entirely.

[asifsmohammed]

These tests should be removed. They are invalid