cockroachdb / cockroachdb/cockroach
cli: handle non compatible security options when insecure flag is set
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
Currently we don't handle the case where we are starting the cockrorach node with `--insecure` flag and at the same time providing TLS based security options(i.e. `--cert-principal-map`, `root-cert-distinguished-name`, `-node-cert-distinguished-name`, `--tls-cipher-suites`. The behavoiur is not properly defined and can be one of the following:
1. Ignore the insecure flag and proceed with starting a TLS rpc, sql, http server with the restrictions provided in the TLS flags
2. Ignore the TLS flags and proceed with the TLS flags as no-op and maybe provide a warning.
3. Probably error out if both are set, with crdb server failing to start with a fatal failure.
Depending on the decision we need to revisit the flags defined here: https://github.com/cockroachdb/cockroach/blob/master/pkg/cli/flags.go#L1155-L1169
Jira issue: CRDB-49708
Epic CC-33751
Contributor guide
Assessment
This issue has not been assessed yet.