lightning: support Re/ReregisterMySQL by different tls name

br/pkg/lightning/config/config.go

@@ -552,27 +552,40 @@ type Security struct {
 	KeyPath  string `toml:"key-path" json:"key-path"`
 	// RedactInfoLog indicates that whether enabling redact log
 	RedactInfoLog bool `toml:"redact-info-log" json:"redact-info-log"`
+
+	// this is used to set tls config for lightning in DM
+	// DM may running many lightning instances at same time, so we need to set different tls config name for each lightning
+	TLSConfigName string `toml:"tls-config-name" json:"tls-config-name"`
 }
 
-// RegistersMySQL registers (or deregisters) the TLS config with name "cluster"
+// RegistersMySQL registers the TLS config with name "cluster" or security.TLSConfigName
 // for use in `sql.Open()`. This method is goroutine-safe.
 func (sec *Security) RegisterMySQL() error {
 	if sec == nil {
 		return nil
 	}
+	if sec.TLSConfigName == "" {
+		sec.TLSConfigName = "cluster" // this the default value in Config.TiDB.TLS, see more in `CheckAndAdjustSecurity`
+	}
 	tlsConfig, err := common.ToTLSConfig(sec.CAPath, sec.CertPath, sec.KeyPath)
-	switch {
-	case err != nil:
+	if err != nil {
 		return errors.Trace(err)
-	case tlsConfig != nil:
+	}
+	if tlsConfig != nil {
 		// error happens only when the key coincides with the built-in names.
-		_ = gomysql.RegisterTLSConfig("cluster", tlsConfig)
-	default:
-		gomysql.DeregisterTLSConfig("cluster")
+		_ = gomysql.RegisterTLSConfig(sec.TLSConfigName, tlsConfig)
 	}
 	return nil
 }
 
+// DeregisterMySQL deregisters the TLS config with security.TLSConfigName
+func (sec *Security) DeregisterMySQL() {
+	if sec == nil {
+		return
+	}
+	gomysql.DeregisterTLSConfig(sec.TLSConfigName)
+}
+
 // A duration which can be deserialized from a TOML string.
 // Implemented as https://github.com/BurntSushi/toml#using-the-encodingtextunmarshaler-interface
 type Duration struct {

br/pkg/lightning/config/config_test.go

@@ -307,6 +307,15 @@ func (s *configTestSuite) TestAdjustSecuritySection(c *C) {
 			expectedCA:  "",
 			expectedTLS: "skip-verify",
 		},
+		{
+			input: `
+				[security]
+				ca-path = "/path/to/ca.pem"
+				tls-config-name = "third-name"
+			`,
+			expectedCA:  "/path/to/ca.pem",
+			expectedTLS: "cluster",
+		}, // test set tls-config-name not affects TiDB.TLS
 	}
 
 	for _, tc := range testCases {

br/pkg/lightning/lightning.go

@@ -274,10 +274,7 @@ func (l *Lightning) run(taskCtx context.Context, taskCfg *config.Config, g glue.
 		if taskCfg.TiDB.Security == nil {
 			return
 		}
-		taskCfg.TiDB.Security.CAPath = ""
-		if err := taskCfg.TiDB.Security.RegisterMySQL(); err != nil {
-			log.L().Warn("failed to deregister TLS config", log.ShortError(err))
-		}
+		taskCfg.TiDB.Security.DeregisterMySQL()
 	}()
 
 	// initiation of default glue should be after RegisterMySQL, which is ready to be called after taskCfg.Adjust