cockroachdb / cockroachdb/cockroach
Support Unique Client Certificate CA For Each Virtual Cluster
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
Currently, CockroachDB only supports a single client cert certificate authority per crdb node. In a unified architecture deployment, that means the CA is shared by each virtual cluster served by the node. A consequence of this is the controller of the CA's private key has root access to the system cluster because they could use the CA to mint a certificate for the root user and connect to the system cluster.
This is relevant for Cockroach Cloud because dedicated allows the user to supply their own certificate authority certificate. https://www.cockroachlabs.com/docs/cockroachcloud/client-certs-dedicated#upload-a-certificate-authority-ca-certificate-for-a-cockroachdb-dedicated-cluster Ideally it would be possible to configure a unique client CA for each virtual cluster so that the user supplied certificate would only be allowed to connect to the application virtual cluster.
Jira issue: CRDB-36395
Epic CRDB-36299
Contributor guide
Assessment
This issue has not been assessed yet.