Feature/ssl #2584
Feature/ssl #2584
Conversation
|
Close #2587 |
Sophie-Xie
requested review from
CPWstatic and
jievince
and removed request for
a team
The test certificates generating require interaction, and almost other open source projects like even openssl also put the test certificates to source code, so we follow them. |
src/common/ssl/SSLConfig.cpp
Outdated
| DEFINE_string(ca_path, "", "Path to trusted CA file."); | ||
| DEFINE_bool(enable_ssl, false, "Whether enable ssl."); | ||
| DEFINE_bool(enable_graph_ssl, false, "Whether enable ssl of graph server."); | ||
| DEFINE_bool(enable_meta_ssl, false, "Whether enable ssl of meta server."); |
There was a problem hiding this comment.
it seems that two flags is enough to cover the cases about inside and outside the nebula cluster. Do we really need to add another meta_ssl for users to make a decision?
There was a problem hiding this comment.
It's the suggestion from @sherman-the-tank , which to encrypt the sensitive data in meta.
There was a problem hiding this comment.
I mean whether enable_ssl and enable_graphd_ssl can already cover the enable_meta_ssl scenario, just like below:
* enable_graphd_ssl=true & enable_ssl=false
clients <- ssl -> graphd <- no ssl -> metad <- no ssl -> storaged
^ ^
|______________ no ssl ______________|
* enable_graphd_ssl=false & enable_ssl=true
clients <- no ssl -> graphd <- ssl -> metad <- ssl -> storaged
^ ^
|______________ ssl ______________|
* enable_graphd_ssl=true & enable_ssl=true
clients <- ssl -> graphd <- ssl -> metad <- ssl -> storaged
^ ^
|______________ ssl ______________|
* enable_graphd_ssl=false & enable_ssl=false
clients <- no ssl -> graphd <- no ssl -> metad <- no ssl -> storaged
^ ^
|______________ no ssl ______________|
Is enable_meta_ssl just to encrypt schema information when communicating with meta? If so, make sense.
See detail in #2556 , the client should be implemented by corresponding maintainer @vesoft-inc/graph-reviewers
The test certificates generating require interactive, and almost other open source projects like even openssl also put the test certificates to source code, so we follow them.
Close #2587