Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

--cert-principal-map should allow operators to update the map after init without restarting #54155

Closed
aaron-crl opened this issue Sep 9, 2020 · 4 comments
Closed

--cert-principal-map should allow operators to update the map after init without restarting #54155

aaron-crl opened this issue Sep 9, 2020 · 4 comments
Labels
A-authentication Pertains to authn subsystems A-cc-enablement Pertains to current CC production issues or short-term projects A-cli-server CLI commands that pertain to CockroachDB server processes A-kv-server Relating to the KV-level RPC server C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. T-server-and-security DB Server & Security X-server-triaged-202105

Comments

@aaron-crl
Copy link

Issue
As implemented, an operator must restart nodes to update the values of --cert-principal-map. This is also a command line flag suggesting it only applies to the instance when it should(?) represent a cluster setting. This constitutes a UX surprise.

Proposed solution
Add the ability for an operator to update/override the mappings as a cluster setting that will persist through restarts.

cc @thtruo @knz
@aaron-crl aaron-crl added A-cli A-kv-server Relating to the KV-level RPC server labels Sep 9, 2020
@blathers-crl
Copy link

blathers-crl bot commented Sep 9, 2020

Hi @aaron-crl, please add a C-ategory label to your issue. Check out the label system docs.

🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is otan.

@aaron-crl aaron-crl added the C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) label Sep 9, 2020
@knz knz added the S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. label Sep 10, 2020
@knz knz added A-cli-server CLI commands that pertain to CockroachDB server processes and removed A-cli labels Mar 20, 2021
@jlinder jlinder added the T-server-and-security DB Server & Security label Jun 16, 2021
@knz knz added A-authentication Pertains to authn subsystems A-cc-enablement Pertains to current CC production issues or short-term projects labels Jul 29, 2021
@bobvawter
Copy link
Member

Isn't this #47196?

@knz
Copy link
Contributor

knz commented Sep 8, 2021

Solving the other issue will also solve this one, yes, but if we decide that we refuse to do the PG thing we still need to fix the cert principal map.

@knz
Copy link
Contributor

knz commented Feb 15, 2022

We now support the ident map.

@knz knz closed this as completed Feb 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
A-authentication Pertains to authn subsystems A-cc-enablement Pertains to current CC production issues or short-term projects A-cli-server CLI commands that pertain to CockroachDB server processes A-kv-server Relating to the KV-level RPC server C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. T-server-and-security DB Server & Security X-server-triaged-202105
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jlinder @knz @bobvawter @aaron-crl