pingcap / pingcap/tiup

tiup: should enhance the support for deploy with hostname instead of ip

Open
#1,937 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type/bug
Dominant language
Go
Stars
466
Forks
338
Avg merge
3d 7h
Merged PRs (30d)
8

Description

Bug Report

Please answer these questions before submitting your issue. Thanks!

  1. What did you do?

Deploy one cluster with tls enabled between all components in k8s dockers, part of topo list as following,
tikv_servers:

  • host: tikv1-peer
    port: 20160
    status_port: 20180
    config:
    server.labels:
    dc: dc1
    zone: zone1
    host: host1
  1. What did you expect to see?
    Every things works fine.

  2. What did you see instead?

Found the tikv ips is not added to the certificate.

MySQL [(none)]> show config where type='tikv';
Empty set, 3 warnings (0.09 sec)

MySQL [(none)]> show warnings;
+---------+------+-------------------------------------------------------------------------------------------------------+
| Level | Code | Message |
+---------+------+-------------------------------------------------------------------------------------------------------+
| Warning | 1105 | Get "https://10.233.80.87:20180/config": x509: certificate is valid for 127.0.0.1, not 10.233.80.87 |
| Warning | 1105 | Get "https://10.233.98.159:20180/config": x509: certificate is valid for 127.0.0.1, not 10.233.98.159 |
| Warning | 1105 | Get "https://10.233.113.26:20180/config": x509: certificate is valid for 127.0.0.1, not 10.233.113.26 |
+---------+------+-------------------------------------------------------------------------------------------------------+
3 rows in set (0.00 sec)

  1. What version of TiUP are you using (tiup --version)?

sh-4.2# tiup --version
1.9.1 tiup
Go Version: go1.17.7
Git Ref: v1.9.1
GitHash: 8c9d75df55c48e3cd645c2eea1fb0c51cfcd92d0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the tiup deploy flow described in the report, reproducing a TLS-enabled cluster in Kubernetes Docker containers with hostname-based topology entries such as tikv1-peer. Inspect the generated certificate identities and the TiKV configuration requests; done means the TiKV IPs or hostnames are accepted by the certificates and the reported x509 warnings no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.