Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

*: support require-secure-transport startup option (#15341) (#15415) #15442

Merged
merged 4 commits into from
Mar 18, 2020
Merged

*: support require-secure-transport startup option (#15341) (#15415) #15442

merged 4 commits into from
Mar 18, 2020

Conversation

sre-bot
Copy link
Contributor

@sre-bot sre-bot commented Mar 18, 2020

cherry-pick #15415 to release-3.1

cherry-pick #15341 to release-3.0

What problem does this PR solve?

fixes #15306

What is changed and how it works?

  • add --require-secure-transport startup option
  • reject non-TLS client connect to TiDB if require-secure-transport be enabled
  • startup failure if require-secure-transport be enabled but no avaliable cert/key/ca
  • reload failure if require-secure-transport be enabled event if with no rollback on error

Check List

Tests

  • Unit test
  • Integration test
  • Manual test
enable `require-secure-transport` and try non-TLS client

Code changes

  • imple change

Side effects

  • n/a

Related changes

  • Need to cherry-pick to the release branch
  • Need to update the documentation
  • Need to update the tidb-ansible repository

Release note

  • support --require-secure-transport startup option.

This change is Reviewable

@sre-bot
Copy link
Contributor Author

sre-bot commented Mar 18, 2020

/run-all-tests

@sre-bot sre-bot mentioned this pull request Mar 18, 2020
Merged
@lysu lysu removed the request for review from siddontang March 18, 2020 03:39
@lysu
Copy link
Contributor

lysu commented Mar 18, 2020

need merge pingcap/parser#780 first

@lysu lysu self-assigned this Mar 18, 2020
@lysu lysu removed their request for review March 18, 2020 03:48
@lysu
Copy link
Contributor

lysu commented Mar 18, 2020

/run-all-tests

@lysu
Copy link
Contributor

lysu commented Mar 18, 2020

@jackysp @imtbkcat PTAL thx

imtbkcat
imtbkcat reviewed Mar 18, 2020
View reviewed changes
Copy link

@imtbkcat imtbkcat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

jackysp
jackysp approved these changes Mar 18, 2020
View reviewed changes
Copy link
Member

@jackysp jackysp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jackysp
Copy link
Member

jackysp commented Mar 18, 2020

/merge

@sre-bot sre-bot added the status/can-merge Indicates a PR has been approved by a committer. label Mar 18, 2020
@sre-bot
Copy link
Contributor Author

sre-bot commented Mar 18, 2020

/run-all-tests

@sre-bot sre-bot merged commit 90666d9 into pingcap:release-3.1 Mar 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@imtbkcat imtbkcat imtbkcat left review comments

@jackysp jackysp jackysp approved these changes

@kolbe kolbe Awaiting requested review from kolbe

Assignees

@lysu lysu

Labels
component/config component/server priority/release-blocker This issue blocks a release. Please solve it ASAP. security Everything related with security sig/execution SIG execution status/can-merge Indicates a PR has been approved by a committer. type/3.1-cherry-pick
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@sre-bot @lysu @jackysp @imtbkcat