Skip to content

Add SslCaCrt field to TGenericConnectorConfig #2102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vitalyisaev2 merged 2 commits into from
Feb 20, 2024
Merged

Add SslCaCrt field to TGenericConnectorConfig #2102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06459d6
Add 'SslCaCrt' field to 'TGenericConnectorConfig'
vitalyisaev2 Feb 20, 2024
a44ea94
review fixes pt. 1
vitalyisaev2 Feb 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions ydb/library/yql/providers/common/proto/gateways_config.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,9 +592,11 @@ message TGenericClusterConfig {
message TGenericConnectorConfig {
// Connector instance network endpoint
optional NYql.NConnector.NApi.TEndpoint Endpoint = 3;
// If true, GRPC Client will use TLS encryption.
// Server cert will be verified with system CA cert pool.
// If true, Connector GRPC Client will use TLS encryption.
optional bool UseSsl = 4;
// Path to the custom CA certificate to verify Connector's certs.
// If empty, the default system CA certificate pool will be used.
optional string SslCaCrt = 5;

reserved 1, 2;
}
Expand Down
14 changes: 12 additions & 2 deletions ydb/library/yql/providers/generic/connector/libcpp/client.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
#include <util/stream/file.h>

#include "client.h"

namespace NYql::NConnector {
Expand All @@ -21,10 +23,18 @@ namespace NYql::NConnector {
public:
TClientGRPC() = delete;
TClientGRPC(const TGenericConnectorConfig& config) {
TString endpoint = TStringBuilder() << config.GetEndpoint().host() << ":" << ToString(config.GetEndpoint().port());
GrpcConfig_ = NYdbGrpc::TGRpcClientConfig(endpoint);
GrpcConfig_ = NYdbGrpc::TGRpcClientConfig();
GrpcConfig_.Locator = TStringBuilder() << config.GetEndpoint().host() << ":" << config.GetEndpoint().port();
GrpcConfig_.EnableSsl = config.GetUseSsl();

// Read content of CA cert
TString rootCertData;
if (config.GetSslCaCrt()) {
rootCertData = TFileInput(config.GetSslCaCrt()).ReadAll();
}

GrpcConfig_.SslCredentials = grpc::SslCredentialsOptions{.pem_root_certs = rootCertData, .pem_private_key = "", .pem_cert_chain = ""};

GrpcClient_ = std::make_unique<NYdbGrpc::TGRpcClientLow>();

// FIXME: is it OK to use single connection during the client lifetime?
Expand Down