pingcap / pingcap/tidb-operator
Make initial account setup more secure.
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 540
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 18
Description
Feature Request
Currently TidbInitializer can connect to the cluster and setup list of accounts based on a secret.
(docs: https://docs.pingcap.com/tidb-in-kubernetes/stable/initialize-a-cluster/#set-initial-account-and-password )
The problem with this is that there is some time in between where the cluster is deployed and when the accounts are configured that might allow someone to access the cluster.
Workaround: Disallow network access to the cluster until it is fully configured.
Possible solution 1:
- Start the cluster with
--initialize-secureand/or with only UNIX socket access. - Setup the accounts
- Restart the TiDB instance if needed to allow network access
Possible solution 2:
Use --initialize-sql-file to setup the accounts during TiDB startup.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating TidbInitializer and reviewing how it currently connects and configures accounts, then compare the documented --initialize-secure, UNIX socket, and --initialize-sql-file approaches. Define the selected initialization flow and verify that accounts are configured before network access is available, using any existing project tests you find around TidbInitializer.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100