Comments (5)
Can I implement this issue ?
from cockroach.
Of course, please go ahead! Happy to have you on.
from cockroach.
No change needs to happen in "client". I don't think we need DialTLS.
I recommend:
- Continue to use the Certs directory but rather then using the node.{crt,key}, we use client.{crt.key}.
- Should the client connections and rpc connections share the ca.crt?
- Make a new package "util/tls" and move "rpc/tls.go" to the new package.
- Use the tls package in rpc and server.
- Parse the rpc and server certificates in Context.Init and store resulting TLS certificates in the Context.
Tests can generate a self signed certificate and add the trust to the client transport. Most tests will not need to populate the -Certs flag, but rather directly populate the Context certificates.
If someone can vet the above I can implement.
from cockroach.
For now, yes, just make a client cert/key in the certs directory. I think the certs directory is going away at some point though. Same ca.crt for client and server. There's a flag that can be set in a certificate to indicate whether it is for client or server use; we should be setting that and rejecting certs that are being used in the wrong direction. The rest sounds good.
from cockroach.
done for now. All nodes and clients can talk SSL. Lots of details left (client certs, key rotation, different certs for nodes, etc...) but the basics are there.
from cockroach.
Related Issues (20)
- Sentry: cmd_recover_txn.go:138: failed indeterminate commit recovery: programming error: timestamp change by implicitly committed transaction: 1723844044.464600007,2->1723844039.636684976,0 (1) Wraps:... HOT 1
- sql: builtin hlc_to_timestamp doesn't handle decimals with exponents other than -10 HOT 1
- storage: per-category metrics not displaying in the db console HOT 1
- roachtest: schemachange/mixed-versions failed [count-leases: column "crdb_region" does not exist] HOT 1
- roachtest: django failed
- pkg/sql/logictest/tests/cockroach-go-testserver-upgrade-to-master/cockroach-go-testserver-upgrade-to-master_test: TestLogic_mixed_version_external_connections_owner_id failed
- roachtest: schemachange/mixed-versions failed HOT 1
- roachtest: backup-restore/round-trip failed
- kv/kvserver: TestTimeSeriesMaintenanceQueue failed
- roachtest: follower-reads/mixed-version/survival=region/locality=global/reads=strong failed
- roachtest: unoptimized-query-oracle/disable-rules=half/rand-tables failed
- roachtest: schemachange/random-load failed [argument of DEFAULT must be type void, not type string] HOT 5
- roachtest: tpcc/large-schema-benchmark/multiregion=true/tables=5000 failed
- roachtest: follower-reads/mixed-version/single-region failed
- pkg/ccl/logictestccl/tests/3node-tenant/3node-tenant_test: TestTenantLogic_schema_change_in_txn failed
- ccl/changefeedccl: TestChangefeedRandomExpressions failed
- sql: TestRelocateNonVoters failed
- kv/kvserver: TestPromoteNonVoterInAddVoter failed
- Sentry: catch.go:29: runtime error: invalid memory address or nil pointer dereference (1) assertion failure Wraps: (2) attached stack trace -- stack trace: | github.com/cockroachdb/cockroach/pkg/u...
- sql/pgwire: TestAuthenticationAndHBARules failed
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cockroach.