feat: support secure Hubble monitoring targets

hugegraph-pd/hg-pd-common/src/main/java/org/apache/hugegraph/pd/util/StoreRestAddressUtil.java

@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hugegraph.pd.util;
+
+import java.net.URI;
+import java.util.Optional;
+
+import org.apache.hugegraph.pd.grpc.Metapb;
+
+public final class StoreRestAddressUtil {
+
+    private static final String REST_PORT_LABEL = "rest.port";
+
+    private StoreRestAddressUtil() {
+    }
+
+    public static String getRestAddress(Metapb.Store store) {
+        if (store == null || store.getAddress().isEmpty()) {
+            return null;
+        }
+
+        Optional<String> label = store.getLabelsList().stream()
+                                      .filter(item -> REST_PORT_LABEL.equals(
+                                              item.getKey()))
+                                      .map(Metapb.StoreLabel::getValue)
+                                      .findFirst();
+        if (!label.isPresent()) {
+            return null;
+        }
+
+        int port;
+        try {
+            port = Integer.parseInt(label.get().trim());
+        } catch (NumberFormatException ignored) {
+            return null;
+        }
+        if (port < 1 || port > 65535) {
+            return null;
+        }
+
+        try {
+            String address = store.getAddress().trim();
+            URI uri = address.contains("://") ? URI.create(address) :
+                      URI.create("http://" + address);
+            String host = uri.getHost();
+            if (host == null || host.isEmpty()) {
+                return null;
+            }
+            String hostPart = host.contains(":") && !host.startsWith("[") ?
+                              "[" + host + "]" : host;
+            return hostPart + ":" + port;
+        } catch (IllegalArgumentException ignored) {
+            return null;
+        }
+    }
+}

hugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/config/PDConfig.java

@@ -31,6 +31,7 @@
 import org.springframework.stereotype.Component;
 
 import lombok.Data;
+import lombok.ToString;
 
 /**
  * PD profile
@@ -69,6 +70,7 @@ public class PDConfig {
     private ThreadPoolGrpc threadPoolGrpc;
 
     @Value("${auth.secret-key: 'FXQXbJtbCLxODc6tGci732pkH1cyf8Qg'}")
+    @ToString.Exclude
     private String secretKey;
 
     @Autowired

hugegraph-pd/hg-pd-service/src/main/java/org/apache/hugegraph/pd/rest/StoreAPI.java

@@ -33,6 +33,7 @@
 import org.apache.hugegraph.pd.model.TimeRangeRequest;
 import org.apache.hugegraph.pd.service.PDRestService;
 import org.apache.hugegraph.pd.util.DateUtil;
+import org.apache.hugegraph.pd.util.StoreRestAddressUtil;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.DeleteMapping;
@@ -278,6 +279,7 @@ class StoreStatistics {
         // store statistics
         String storeId;
         String address;
+        String restAddress;
         String raftAddress;
         String version;
         String state;
@@ -302,6 +304,7 @@ class StoreStatistics {
             if (store != null) {
                 storeId = String.valueOf(store.getId());
                 address = store.getAddress();
+                restAddress = StoreRestAddressUtil.getRestAddress(store);
                 raftAddress = store.getRaftAddress();
                 state = String.valueOf(store.getState());
                 version = store.getVersion();

hugegraph-pd/hg-pd-service/src/main/java/org/apache/hugegraph/pd/service/SDConfigService.java

@@ -22,7 +22,6 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
@@ -33,6 +32,7 @@
 import org.apache.hugegraph.pd.common.PDException;
 import org.apache.hugegraph.pd.config.PDConfig;
 import org.apache.hugegraph.pd.grpc.Metapb;
+import org.apache.hugegraph.pd.util.StoreRestAddressUtil;
 import org.apache.hugegraph.pd.grpc.Pdpb;
 import org.apache.hugegraph.pd.grpc.discovery.NodeInfo;
 import org.apache.hugegraph.pd.grpc.discovery.NodeInfos;
@@ -215,34 +215,14 @@ private Set<String> getStoreAddresses() {
         return res;
     }
 
-    // TODO: optimized store registry data, to add host:port of REST server.
+    // Keep the legacy gRPC fallback when no valid REST port is registered.
     private String getRestAddress(Metapb.Store store) {
         String address = store.getAddress();
         if (address == null || address.isEmpty()) {
             return null;
         }
-        try {
-            Optional<String> port = store.getLabelsList().stream().map(
-                    e -> {
-                        if ("rest.port".equals(e.getKey())) {
-                            return e.getValue();
-                        }
-                        return null;
-                    }).filter(e -> e != null).findFirst();
-
-            if (port.isPresent()) {
-                java.net.URI uri = address.contains("://")
-                                   ? java.net.URI.create(address)
-                                   : java.net.URI.create("http://" + address);
-                String host = uri.getHost() != null ? uri.getHost() : address;
-                String hostPart =
-                        host.contains(":") && !host.startsWith("[") ? "[" + host + "]" : host;
-                address = hostPart + ":" + port.get().trim();
-            }
-        } catch (Throwable t) {
-            log.error("Failed to extract the REST address of store, cause by:", t);
-        }
-        return address;
+        String restAddress = StoreRestAddressUtil.getRestAddress(store);
+        return restAddress != null ? restAddress : address;
 
     }
 

hugegraph-pd/hg-pd-test/src/main/java/org/apache/hugegraph/pd/core/PDConfigTest.java

@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hugegraph.pd.core;
+
+import org.apache.hugegraph.pd.config.PDConfig;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class PDConfigTest {
+
+    @Test
+    public void testToStringDoesNotExposeSecretKey() {
+        PDConfig config = new PDConfig();
+        config.setClusterId(123L);
+        config.setDataPath("pd-test-data");
+        config.setInitialStoreList("");
+        config.setSecretKey("secret-value-that-must-not-appear");
+
+        String text = config.toString();
+
+        Assert.assertEquals("secret-value-that-must-not-appear",
+                            config.getSecretKey());
+        Assert.assertFalse(text.contains("secret-value-that-must-not-appear"));
+        Assert.assertFalse(text.contains("secretKey"));
+        Assert.assertTrue(text.contains("clusterId=123"));
+        Assert.assertTrue(text.contains("dataPath=pd-test-data"));
+    }
+}

hugegraph-pd/hg-pd-test/src/main/java/org/apache/hugegraph/pd/core/PDCoreSuiteTest.java

@@ -31,6 +31,7 @@
 @Suite.SuiteClasses({
         MetadataKeyHelperTest.class,
         HgKVStoreImplTest.class,
+        PDConfigTest.class,
         ConfigServiceTest.class,
         IdServiceTest.class,
         KvServiceTest.class,

hugegraph-pd/hg-pd-test/src/main/java/org/apache/hugegraph/pd/rest/PDRestSuiteTest.java

@@ -17,6 +17,7 @@
 
 package org.apache.hugegraph.pd.rest;
 
+import org.apache.hugegraph.pd.util.StoreRestAddressUtilTest;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
@@ -25,6 +26,7 @@
 @RunWith(Suite.class)
 @Suite.SuiteClasses({
         RestApiTest.class,
+        StoreRestAddressUtilTest.class,
 })
 @Slf4j
 public class PDRestSuiteTest {

hugegraph-pd/hg-pd-test/src/main/java/org/apache/hugegraph/pd/util/StoreRestAddressUtilTest.java

@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hugegraph.pd.util;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import org.apache.hugegraph.pd.grpc.Metapb;
+import org.junit.Test;
+
+public class StoreRestAddressUtilTest {
+
+    @Test
+    public void testBuildIPv4RestAddress() {
+        Metapb.Store store = store("127.0.0.1:8500", "8520");
+
+        assertEquals("127.0.0.1:8520",
+                     StoreRestAddressUtil.getRestAddress(store));
+    }
+
+    @Test
+    public void testBuildIPv6RestAddress() {
+        Metapb.Store store = store("[2001:db8::1]:8500", "8520");
+
+        assertEquals("[2001:db8::1]:8520",
+                     StoreRestAddressUtil.getRestAddress(store));
+    }
+
+    @Test
+    public void testBuildRestAddressFromUri() {
+        Metapb.Store store = store("http://store.example:8500", "8520");
+
+        assertEquals("store.example:8520",
+                     StoreRestAddressUtil.getRestAddress(store));
+    }
+
+    @Test
+    public void testRejectMissingOrInvalidRestPort() {
+        assertNull(StoreRestAddressUtil.getRestAddress(
+                store("127.0.0.1:8500", null)));
+        assertNull(StoreRestAddressUtil.getRestAddress(
+                store("127.0.0.1:8500", "0")));
+        assertNull(StoreRestAddressUtil.getRestAddress(
+                store("127.0.0.1:8500", "65536")));
+        assertNull(StoreRestAddressUtil.getRestAddress(
+                store("127.0.0.1:8500", "8520/path")));
+    }
+
+    @Test
+    public void testRejectMissingOrMalformedStoreAddress() {
+        assertNull(StoreRestAddressUtil.getRestAddress(store("", "8520")));
+        assertNull(StoreRestAddressUtil.getRestAddress(
+                store("2001:db8::1:8500", "8520")));
+    }
+
+    private static Metapb.Store store(String address, String restPort) {
+        Metapb.Store.Builder builder = Metapb.Store.newBuilder()
+                                                   .setAddress(address);
+        if (restPort != null) {
+            builder.addLabels(Metapb.StoreLabel.newBuilder()
+                                               .setKey("rest.port")
+                                               .setValue(restPort));
+        }
+        return builder.build();
+    }
+}