-
Notifications
You must be signed in to change notification settings - Fork 425
feat: reloadable tls client config #7230
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: reloadable tls client config #7230
Conversation
caf3366 to
cfcf157
Compare
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
Signed-off-by: shuiyisong <[email protected]>
bfdaeda to
1e60e34
Compare
|
To be clear, in this patch we only changed intra-cluster grpc client to reload certificate. The grpc server is not covered, right? |
Yes, this only change the gRPC client(channel manager) to be able to reload the TLS change. The gRPC server of the database is not changed. |
|
This can introduce an issue if all clients reloads certs automatically but server doesn't. The updated client will not be able to connect to server without a restart. |
sunng87
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Confirmed with @shuiyisong , this will be used for communication between database and external services like authentication providers or something.
But we still need to ensure the cert reload will work if intra-cluster grpc is configured with tls.
Signed-off-by: shuiyisong <[email protected]>
I hereby agree to the terms of the GreptimeDB CLA.
Refer to a related PR or issue link (optional)
What's changed and what's your intention?
This patch introduces the ability for
channel_managerto use a re-loadable client TLS config to automatically reload the TLS files when changed.The
ReloadableTlsServerConfigis now extracted intoreloadable_tlsfor reuse.PR Checklist
Please convert it to a draft if some of the following conditions are not met.