Nifi Registry Git 连接器

Question

我的 Nifi Registry 0.5.0 与我的 Nifi 1.9.2 集群一起安装，并且版本控制正常工作。但是，在将注册表推送到 git 存储库时，我们会看到以下内容。

2020-03-02 10:19:53,183 ERROR [GitFlowMetaData Push thread] o.a.n.r.p.flow.git.GitFlowMetaData Failed to push commits to origin due to org.eclipse.jgit.api.errors.TransportException: https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git: Secure connection to https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git could not be stablished because of SSL problems
org.eclipse.jgit.api.errors.TransportException: https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git: Secure connection to https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git could not be stablished because of SSL problems
        at org.eclipse.jgit.api.PushCommand.call(PushCommand.java:180)
        at org.apache.nifi.registry.provider.flow.git.GitFlowMetaData.lambda$startPushThread$1(GitFlowMetaData.java:225)
        at org.apache.nifi.registry.provider.flow.git.GitFlowMetaData$$Lambda$370/853913427.run(Unknown Source)
        at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
        at java.util.concurrent.FutureTask.runAndReset(Unknown Source)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(Unknown Source)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
        at java.lang.Thread.run(Unknown Source)
Caused by: org.eclipse.jgit.errors.TransportException: https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git: Secure connection to https://svc_nifi@gitlab.intranet.net/gitlab/nifi/flows.git could not be stablished because of SSL problems
        at org.eclipse.jgit.transport.TransportHttp.handleSslFailure(TransportHttp.java:617)
        at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:567)
        at org.eclipse.jgit.transport.TransportHttp.openPush(TransportHttp.java:435)
        at org.eclipse.jgit.transport.PushProcess.execute(PushProcess.java:160)
        at org.eclipse.jgit.transport.Transport.push(Transport.java:1344)
        at org.eclipse.jgit.api.PushCommand.call(PushCommand.java:169)
        ... 9 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
        at java.net.HttpURLConnection.getResponseCode(Unknown Source)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
        at org.eclipse.jgit.transport.http.JDKHttpConnection.getResponseCode(JDKHttpConnection.java:108)
        at org.eclipse.jgit.util.HttpSupport.response(HttpSupport.java:205)
        at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:498)
        ... 13 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
        at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
        at sun.security.validator.Validator.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
        ... 30 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
        at java.security.cert.CertPathBuilder.build(Unknown Source)
        ... 36 common frames omitted

我尝试将 SSL 证书添加到密钥和信任库（在 nifi-registry.properties 中配置的那些）。我知道我可以在服务器上使用 git 存储库，因为我能够在本地克隆它。 git 服务器也使用信任存储中的相同根 CA。

我的 providers.xml 配置是：

<flowPersistenceProvider>
    <class>org.apache.nifi.registry.provider.flow.git.GitFlowPersistenceProvider</class>
    <property name="Flow Storage Directory">/home/nifi/flows</property>
    <property name="Remote To Push">origin</property>
    <property name="Remote Access User">svc_nifi</property>
    <property name="Remote Access Password"><password></property>
</flowPersistenceProvider>

Answer 1

这不是一个理想的解决方案，但我在本地存储库上禁用了 SSL 验证。在继续研究永久解决方案的同时。

Answer 2

刚才遇到了同样的问题 - 通过将 CA 的 SSL 证书附加到正在运行的 JRE 的 cacerts 文件中来解决。

在我的情况下 - nifi 注册表在（官方）docker 容器中产生 - 刚刚从 /etc/pki/java/cacerts（具有正确配置的 CA 信任的 RHEL）到容器的 /usr/local/openjdk-8/jre/lib/security/cacerts 的卷链接并且 SSL 验证工作。