problems connecting to multiple clusters when using TLS
- Dominant language
- C++
- Stars
- 16.7k
- Forks
- 1.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 126
Description
hello,
we are trying to connect to multiple foundationdb clusters (at the same time) using a client.
the setup is like this
cluster1:
- ca1:
- peer.cert.1
- client.cert.1
cluster2:
- ca2:
- peer.cert.2
- client.cert.2
The same client cannot connect to both cluster1 and cluster2 at the same time. -> it seems that the network thread is only able to take TLS settings one time and it will use the same certificate when trying to connect to second cluster.
the issue goes away if we use the same ca1 emitting CA for tls certificates of cluster2
on forums it was suggested that at least on operator side that is a known issue, however i think that as long as both TLS and multiple cluster connections are supported it is unreasonable to expect that all clusters a client will try to connect to have the same certificates and/or the same signing CA.
Another suggestion was to use the multithreaded client - however it seems that only allows multiple threads if the api version is different
Tested with api version 710, fdb server/7.1.15 (expectig this to be the same on latest), java and go clients - v7.1.15
Contributor guide
Research direction
Start by reproducing the reported Java or Go client setup with two FoundationDB clusters using different CAs and certificates, then inspect how the network thread initializes and reuses TLS settings. Done means one client can maintain simultaneous connections to both clusters without requiring a shared signing CA.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, go, java
- Domain
- databases, distributed-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100