pingcap / pingcap/tidb-operator
Istio mtls support
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 540
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 18
Description
Feature Request
Is your feature request related to a problem? Please describe:
I'm using istio 1.6.4 and would like to enable mtls. I've create a tidb cluster with the following:
kubectl create namespace tidb && \
kubectl label namespace tidb istio-injection=enabled && \
kubectl apply -n tidb -f 11-tidb/cluster.yaml
The cluster.yaml looks like the following:
apiVersion: pingcap.com/v1alpha1
kind: TidbCluster
metadata:
name: cluster-1
spec:
version: v4.0.1
timezone: UTC
pvReclaimPolicy: Retain
discovery: {}
pd:
baseImage: registry.cn-beijing.aliyuncs.com/tidb/pd
replicas: 1
storageClassName: high-performance
requests:
storage: "250Gi"
config: {}
tikv:
baseImage: registry.cn-beijing.aliyuncs.com/tidb/tikv
replicas: 1
storageClassName: high-performance
requests:
storage: "250Gi"
config: {}
tidb:
baseImage: registry.cn-beijing.aliyuncs.com/tidb/tidb
replicas: 1
service:
type: ClusterIP
config: {}
This works.
However once I enable mtls like the following:
kubectl apply -n tidb -f 11-tidb/peer-authentication.yaml
with this peer-authentication.yaml file:
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
name: "default"
spec:
mtls:
mode: STRICT
I get this error when running sql statements against it:
ERROR 9001 (HY000): PD server timeout
It would be great if this could be supported.
Describe the feature you'd like:
Support for istio mtls
Describe alternatives you've considered:
I've considered using the native tls of tidb but would rather use istio mtls as I'm using it elsewhere and it theoretically should be more secure as it's checking the certificate from both sides.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the cluster from the provided cluster.yaml and peer-authentication.yaml with Istio injection enabled, then inspect the SQL request path associated with the PD server timeout. Determine the operator changes required for STRICT mTLS support and verify that SQL statements work successfully after applying them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100