Configure the Aerospike XDR Proxy service
Service
The service section configures the connector's listening ports, TLS and network interface.
The following options are available:
Option | Required | Default | Description |
---|---|---|---|
port | no | 8080 | The list of ports the connector listens to. |
address | no | 0.0.0.0 | The list of interface IP addresses the connector binds to. Use 0.0.0.0 for all interfaces. |
tls | Required, if port not specified. | N/A | See Configuring TLS below. |
manage | no | N/A | See Querying and Managing Metrics and Logs below. |
protocol since 2.0.0 | no | TCP | The incoming protocol for the connector. See protocol for details. |
io-threads | no | # of processors. | The number of IO threads to read, parse incoming XDR requests and to write acknowledgments to XDR |
worker-threads | no | # of processors | The number of threads that will invoke the connector to dispatch a record. |
max-concurrent-records | no | 32768 | The maximum number of XDR records to concurrently process in the connector. |
cluster-name | no | product-name | Group or cluster this connector instance belongs to. Used for grouping instances in Prometheus. |
For several examples of the service
section of the /etc/aerospike-xdr-proxy/aerospike-xdr-proxy.yml
, see "Examples" at the bottom of this page.
Protocol
The incoming protocol for the connector. Valid values are:
Protocol | Description |
---|---|
TCP | The change notification source is Aerospike server 5.0 or later. This is the default. |
HTTP_1_1 | The change notification source is Aerospike server prior to 5.0 version. |
HTTP_2 | The change notification source is the ESP connector |
Querying and Managing Metrics and Logs
You can use the Management and Metrics API to query and manage the outbound server metrics and logs via a REST endpoint. These settings are for using the manage
subsection of the service
section to specify the endpoint and (optionally) TLS settings for securing connections.
Option | Required | Default | Description |
---|---|---|---|
port | no | none | The port the connector listens to. |
address | no | 0.0.0.0 | The interface IP address the connector binds to. Use 0.0.0.0 for all interfaces. |
tls | Required if port not specified. | N/A | See Configuring TLS below. |
Configuring TLS
In the tls
option of the service
section and the manage
section, you can specify TLS settings for making secure connections.
The configuration options are:
Option | Required | Default | Description |
---|---|---|---|
port | no | The HTTPS/TLS port the server listens to. | |
key-store | no | The keystore configuration containing the server-side certificate and key. See Configuring a TLS Store. | |
trust-store | no | Default java trust store. | The keystore configuration containing the trusted CA certificates. See Configuring a TLS Store. |
protocols | no | TLSv1.2 | List of allowed TLS protocols. |
ciphers | no | Default java ciphers | List of allowed ciphers. |
revoke-certificates | no | Reject TLS certificates with the serial numbers specified in this list | |
allowed-peer-names | no | List of client (aerospike server nodes) peer names for mutual authentication. If set, only those clients (aerospike server nodes) that present certificates matching the peer names will be allowed to connect. | |
mutual-auth | no | false | Should the outbound connector mutually authenticate the Aerospike server. |
Configuring a TLS store
The key-store
and trust-store
options are for describing how TLS keystores and truststores are configured. All relative file paths are considered relative to the directory in which the configuration file is located.
See Setting Up TLS Keystores for Aerospike Connect for information about creating keystores.
Option | Required | Default | Description |
---|---|---|---|
store-file | yes | The store file. | |
store-password-file | yes | Read store password from this file. | |
key-password-file | no | Read key password from this file. | |
store-type | no | JKS | The keystore type. Valid values are JKS, JCEKS, PKCS12, PKCS11, DKS, Windows_MY, BKS. |
Examples
Clear-text only
service:
port: 8080
address: 192.168.5.154
manage:
address: 0.0.0.0
port: 8902
TLS only
service:
tls:
port: 8443
allowed-peer-names:
- asd.aerospike.com
protocols:
- tlsv1.3
trust-store:
store-file: tls/ca.aerospike.com.truststore.jks
store-password-file: tls/storepass
key-store:
store-file: tls/connector.aerospike.com.keystore.jks
store-password-file: tls/storepass
key-password-file: tls/keypass
manage:
tls:
port: 8903
trust-store:
store-file: tls/ca.aerospike.com.truststore.jks
store-password-file: tls/storepass
key-store:
store-file: tls/connector.aerospike.com.keystore.jks
store-password-file: tls/storepass
key-password-file: tls/keypass
Clear text and TLS
service:
port: 8080
address: 192.168.5.154
tls:
port: 8443
allowed-peer-names:
- asd.aerospike.com
protocols:
- tlsv1.3
trust-store:
store-file: tls/ca.aerospike.com.truststore.jks
store-password-file: tls/storepass
key-store:
store-file: tls/connector.aerospike.com.keystore.jks
store-password-file: tls/storepass
key-password-file: tls/keypass
manage:
address: 0.0.0.0
port: 8902
tls:
port: 8903
trust-store:
store-file: tls/ca.aerospike.com.truststore.jks
store-password-file: tls/storepass
key-store:
store-file: tls/connector.aerospike.com.keystore.jks
store-password-file: tls/storepass
key-password-file: tls/keypass