Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add tls support between drainer and downstream database server #2993

Merged
merged 8 commits into from
Jul 22, 2020
Merged

add tls support between drainer and downstream database server #2993

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0084f0e
add tls support between drainer and downstream database server
lichunzhu Jul 17, 2020
f405536
Merge branch 'master' into addTlsForDrainerSyncer
lichunzhu Jul 20, 2020
e60701a
add tls for checkpoint db
lichunzhu Jul 21, 2020
70957c5
fix bug
lichunzhu Jul 21, 2020
287dc29
Merge branch 'master' into addTlsForDrainerSyncer
lichunzhu Jul 21, 2020
3ff7023
address comments
lichunzhu Jul 22, 2020
132a00d
address comments again
lichunzhu Jul 22, 2020
4147bcd
Merge branch 'master' into addTlsForDrainerSyncer
lichunzhu Jul 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions charts/tidb-drainer/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,26 @@ config-file: |-
cert-allowed-cn = {{ .Values.tlsCluster.certAllowedCN | toJson }}
{{- end -}}
{{- end -}}
{{- if .Values.tlsSyncer }}
{{- if .Values.tlsSyncer.tlsClientSecretName }}
[syncer.to.security]
ssl-ca = "/var/lib/drainer-syncer-tls/ca.crt"
ssl-cert = "/var/lib/drainer-syncer-tls/tls.crt"
ssl-key = "/var/lib/drainer-syncer-tls/tls.key"
{{- if .Values.tlsSyncer.certAllowedCN }}
cert-allowed-cn = {{ .Values.tlsSyncer.certAllowedCN | toJson }}
{{- end -}}
{{- end -}}
{{- if and .Values.tlsSyncer.checkpoint .Values.tlsSyncer.checkpoint.tlsClientSecretName }}
[syncer.to.checkpoint.security]
ssl-ca = "/var/lib/drainer-syncer-checkpoint-tls/ca.crt"
ssl-cert = "/var/lib/drainer-syncer-checkpoint-tls/tls.crt"
ssl-key = "/var/lib/drainer-syncer-checkpoint-tls/tls.key"
{{- if .Values.tlsSyncer.checkpoint.certAllowedCN }}
cert-allowed-cn = {{ .Values.tlsSyncer.checkpoint.certAllowedCN | toJson }}
{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{- define "drainer-configmap.name" -}}
Expand Down
24 changes: 24 additions & 0 deletions charts/tidb-drainer/templates/drainer-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,18 @@ spec:
mountPath: /var/lib/drainer-tls
readOnly: true
{{- end }}
{{- if .Values.tlsSyncer }}
{{- if .Values.tlsSyncer.tlsClientSecretName }}
- name: drainer-syncer-tls
mountPath: /var/lib/drainer-syncer-tls
readOnly: true
{{- end }}
{{- if and .Values.tlsSyncer.checkpoint .Values.tlsSyncer.checkpoint.tlsClientSecretName }}
- name: drainer-syncer-checkpoint-tls
mountPath: /var/lib/drainer-syncer-checkpoint-tls
readOnly: true
{{- end }}
{{- end }}
{{- if and (ne .Values.timezone "UTC") (ne .Values.timezone "") }}
env:
- name: TZ
Expand All @@ -74,6 +86,18 @@ spec:
secret:
secretName: {{ include "drainer.tlsSecretName" . }}
{{- end }}
{{- if .Values.tlsSyncer }}
{{- if .Values.tlsSyncer.tlsClientSecretName }}
- name: drainer-syncer-tls
secret:
secretName: {{ .Values.tlsSyncer.tlsClientSecretName }}
{{- end }}
{{- if and .Values.tlsSyncer.checkpoint .Values.tlsSyncer.checkpoint.tlsClientSecretName }}
- name: drainer-syncer-checkpoint-tls
secret:
secretName: {{ .Values.tlsSyncer.checkpoint.tlsClientSecretName }}
{{- end }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
Expand Down
16 changes: 16 additions & 0 deletions charts/tidb-drainer/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,22 @@ tlsCluster:
certAllowedCN: []
# - TiDB

# The tls config between drainer and the downstream database server (MySQL/TiDB)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# The tls config between drainer and the downstream database server (MySQL/TiDB)
# The TLS config between drainer and the downstream database server (MySQL/TiDB)

tlsSyncer:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
tlsSyncer:
tlsSyncer: {}

tlsClientSecretName:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add comments to explain what's this field is for and what keys should be included in the secret or add an example command as in L41-L43.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggest commenting out the new configurations.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
tlsClientSecretName:
# tlsClientSecretName: ""


# certAllowedCN is the Common Name that allowed
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the difference between this one and the one in L64, please make it clear.

certAllowedCN: []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
certAllowedCN: []
# certAllowedCN: []

# - TiDB

# checkpoint is the tls config for the database we save binlog checkpoint
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# checkpoint is the tls config for the database we save binlog checkpoint
# checkpoint is the TLS config for the database we save binlog checkpoint

# Omit this part if you just want to save checkpoint in downstream database
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this mean?

checkpoint:
tlsClientSecretName:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add an explanation, and if the DB of saving checkpoint is the same as the downstream DB, this can use the same secret as in L53, right? If yes, make it clear in the comments.
And, in this case, if users do not configure the checkpoint, we should use the configuration in L53-L56?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, empty configuration is okay. binlog will fill the security options automatically if [syncer.to.checkpoint.type] if not specified.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
checkpoint:
tlsClientSecretName:
# checkpoint:
# tlsClientSecretName: ""

# certAllowedCN is the Common Name that allowed
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make it clear for the difference with L56.

certAllowedCN: []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
certAllowedCN: []
# certAllowedCN: []

# - TiDB

# Refer to https://github.com/pingcap/tidb-binlog/blob/master/cmd/drainer/drainer.toml
# [security] section will be generated automatically if tlsCluster.enabled is set to true so users do not need to configure it.
config: |
Expand Down