Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sql/demo: server TLS cert for system tenant and secondary tenant is different #94310

Closed
knz opened this issue Dec 27, 2022 · 1 comment · Fixed by #94323
Closed

sql/demo: server TLS cert for system tenant and secondary tenant is different #94310

knz opened this issue Dec 27, 2022 · 1 comment · Fixed by #94323
Assignees
@knz
Labels
C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions)

Comments

@knz
Copy link
Contributor

knz commented Dec 27, 2022 •
edited by cockroach-jira-scripts
Loading

Also, the URL for a secondary tenant currently uses a separate cert file. This is confusing, and prevents the user from quickly switching between tenants by just using the cluster connection option.

Instead, the server cert for secondary tenants should be the same as for the system tenant.

Epic: CRDB-22814

Jira issue: CRDB-22821
@knz knz added C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. labels Dec 27, 2022
@blathers-crl blathers-crl bot added the T-server-and-security DB Server & Security label Dec 27, 2022
@knz knz mentioned this issue Dec 27, 2022
Merged
10 tasks
@knz
Copy link
Contributor Author

knz commented Dec 27, 2022

This issue should be fixed when the following PRs merge:

This was referenced Dec 27, 2022
Merged
Merged
@exalate-issue-sync exalate-issue-sync bot removed the T-server-and-security DB Server & Security label Dec 28, 2022
@craig craig bot closed this as completed in #94323 Dec 30, 2022
@exalate-issue-sync exalate-issue-sync bot added the T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions) label Dec 30, 2022
dhartunian added a commit to dhartunian/cockroach that referenced this issue Jan 3, 2023
@dhartunian
cli: demo uses in-process tenant infrastructure by default
91d8ad9 
Previously, using `--multitenant=true` in demo would run an in-process tenant
that was configured to behave like an out-of-process one.

Given the goal of a unified architecture where all SQL interactions occur with
a tenant context, the multitenant demo will now use the `serverController` to
instantiate tenants, which will mimic UA clusters that will be the default in
the future.

An additional flag `--in-process-tenant` has been added that allows for
overriding this behavior at runtime. Setting this to `false` will use the test
server tenant infra that simulates an "out of process" tenant. This behavior
was retained also to keep prior tenant tests stable.

Informs cockroachdb#94310
Informs cockroachdb#94308.
Epic: CRDB-14537

Release note: None
dhartunian added a commit to dhartunian/cockroach that referenced this issue Jan 4, 2023
@dhartunian
cli: demo uses in-process tenant infrastructure by default
2383347 
Previously, using `--multitenant=true` in demo would run an in-process tenant
that was configured to behave like an out-of-process one.

Given the goal of a unified architecture where all SQL interactions occur with
a tenant context, the multitenant demo will now use the `serverController` to
instantiate tenants, which will mimic UA clusters that will be the default in
the future.

An additional flag `--in-process-tenant` has been added that allows for
overriding this behavior at runtime. Setting this to `false` will use the test
server tenant infra that simulates an "out of process" tenant. This behavior
was retained also to keep prior tenant tests stable.

Informs cockroachdb#94310
Informs cockroachdb#94308.
Epic: CRDB-14537

Release note: None
dhartunian added a commit to dhartunian/cockroach that referenced this issue Jan 5, 2023
@dhartunian
cli: demo uses in-process tenant infrastructure by default
68b5559 
Previously, using `--multitenant=true` in demo would run an in-process tenant
that was configured to behave like an out-of-process one.

Given the goal of a unified architecture where all SQL interactions occur with
a tenant context, the multitenant demo will now use the `serverController` to
instantiate tenants, which will mimic UA clusters that will be the default in
the future.

An additional flag `--in-process-tenant` has been added that allows for
overriding this behavior at runtime. Setting this to `false` will use the test
server tenant infra that simulates an "out of process" tenant. This behavior
was retained also to keep prior tenant tests stable.

Informs cockroachdb#94310
Informs cockroachdb#94308.
Epic: CRDB-14537

Release note: None
craig bot pushed a commit that referenced this issue Jan 5, 2023
@dhartunian
Merge #93344
2f02743 
93344: cli: demo uses in-process tenant infrastructure by default r=knz,aadityasondhi a=dhartunian

Previously, using `--multitenant=true` in demo would run an in-process tenant
that was configured to behave like an out-of-process one.

Given the goal of a unified architecture where all SQL interactions occur with
a tenant context, the multitenant demo will now use the `serverController` to
instantiate tenants, which will mimic UA clusters that will be the default in
the future.

An additional flag `--in-process-tenant` has been added that allows for
overriding this behavior at runtime. Setting this to `false` will use the test
server tenant infra that simulates an "out of process" tenant. This behavior
was retained also to keep prior tenant tests stable.

Informs #94310
Informs #94308.
Epic: CRDB-14537

Release note: None

Co-authored-by: David Hartunian <davidh@cockroachlabs.com>
craig bot pushed a commit that referenced this issue Jan 9, 2023
@knz
Merge #92580
27ebfa8 
92580: server,pgwire: use a single SQL listener for multiple tenants r=rafiss a=knz

Parent PRs:
- [x] #84608
- [x] #91739
- [x] #91744
- [x] #92574
- [x] #92575
- [x] #92576
- [x] #92577
- [x] #92578
- [x] #92579
- [ ] #94901

Fixes #84585.
Informs  #94310.
Epic: CRDB-14537

This commit implements tenant routing using a single SQL network listener.

The tenant name can be specified:

- via the client status param `options`, e.g. `options=-ccrdb:tenant=hello`
- via the database name, e.g. `crdb:tenant-hello.defaultdb`.

Release note (backward-incompatible change): If a SQL database is created with a name that starts with `crdb:tenant-` (e.g. `CREATE DATABASE "crdb:tenant-foo"`, clients will no longer be able to connect to it directly.

Co-authored-by: Raphael 'kena' Poss <knz@thaumogen.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@knz knz

Labels
C-bug Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior. S-3-ux-surprise Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption. T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

cli/demo: simplify the TLS configuration knz/cockroach
1 participant
@knz