apple / apple/foundationdb

problems connecting to multiple clusters when using TLS

Open
#8,722 4 comments 3 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
16.7k
Forks
1.6k
Avg merge
1d 20h
Merged PRs (30d)
126

Description

hello,

we are trying to connect to multiple foundationdb clusters (at the same time) using a client.
the setup is like this

cluster1:
- ca1:
- peer.cert.1
- client.cert.1

cluster2:
- ca2:
- peer.cert.2
- client.cert.2

The same client cannot connect to both cluster1 and cluster2 at the same time. -> it seems that the network thread is only able to take TLS settings one time and it will use the same certificate when trying to connect to second cluster.

the issue goes away if we use the same ca1 emitting CA for tls certificates of cluster2

on forums it was suggested that at least on operator side that is a known issue, however i think that as long as both TLS and multiple cluster connections are supported it is unreasonable to expect that all clusters a client will try to connect to have the same certificates and/or the same signing CA.

Another suggestion was to use the multithreaded client - however it seems that only allows multiple threads if the api version is different

Tested with api version 710, fdb server/7.1.15 (expectig this to be the same on latest), java and go clients - v7.1.15

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported Java or Go client setup with two FoundationDB clusters using different CAs and certificates, then inspect how the network thread initializes and reuses TLS settings. Done means one client can maintain simultaneous connections to both clusters without requiring a shared signing CA.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, go, java
Domain
databases, distributed-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.