DB cluster configuration to define if CQL session should enable TLS or not #3711
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
karol-kokoszka
changed the title
karol-kokoszka
force-pushed
the
kk/3679-cluster-param-indicating-TLS-enabled
branch
from
04bada9 to
35addef
Compare
karol-kokoszka
force-pushed
the
kk/3679-cluster-param-indicating-TLS-enabled
branch
5 times, most recently
from
246f24d to
dd0125d
Compare
karol-kokoszka
force-pushed
the
kk/3679-cluster-param-indicating-TLS-enabled
branch
from
dd0125d to
5381e2d
Compare
|
Also, the |
|
Also, there are more failures in gh actions then expected, but they look like errors not connected to this PR. |
…use non SSL port on cluster Manager 3.2.6 gives a possibility of explicitly disabling TLS on session even though the certificate and key are available `force_tls_disabled`. Besides that, there is an option to force session to always use non-tls port from scylla config `force_non_ssl_session_port`.
…bled and --force-non-ssl-session-port flags
karol-kokoszka
force-pushed
the
kk/3679-cluster-param-indicating-TLS-enabled
branch
from
5381e2d to
d4f5fbe
Compare
karol-kokoszka
force-pushed
the
kk/3679-cluster-param-indicating-TLS-enabled
branch
from
d4f5fbe to
bdac817
Compare
It adds information about `force-tls-disabled` and `force-non-ssl-session-port` flags.
|
docs are updated with 274388b |
Michal-Leszczynski
approved these changes
Feb 14, 2024
karol-kokoszka
deleted the
kk/3679-cluster-param-indicating-TLS-enabled
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #3679
This PR introduces an additional flags defining the cluster managed by the Scylla Manager:
--force-tls-disabledif true, then TLS on cql session with the cluster will be disabled, no matter if TLS is enabled in scylla.yaml--force-non-ssl-portif true, then for TLS enabled connection, it will always use non-SSL port (ref api: unset config value is being returned by the API scylladb#7206 (comment))If any of these flags is not available in
cluster addthen both are evaluated tofalse.If flag is not available in
cluster updatethen update won't change current state of these flags in DB.Additional tests are introduced,
api-integration-teststhat are suppose to call CLI / HTTP api against docker env and assert results.Please make sure that: