tarantool / tarantool/doc

failover: coordinator SSL client auth via failover.ssl

Open Beginner friendly
#5,648 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
CSS
Stars
15
Forks
49
Avg merge
1d 13h
Merged PRs (30d)
3

Description

A new failover.ssl configuration section can be used to provide SSL
client parameters for the failover coordinator. These parameters are
used for outgoing IPROTO connections to instances when the instance URI
has `params.transport: ssl

Options:

  • failover.ssl

SSL parameters used by the failover coordinator to connect to instances
over IPROTO when SSL is enabled.

  • failover.ssl.ssl_ca_file (Optional)

A path to a trusted certificate authority (CA) file used to verify the
instance certificate. If not set, the coordinator doesn't verify the
instance certificate.

  • failover.ssl.ssl_cert_file (Optional)

A path to the client SSL certificate file used by the coordinator.
Required if instances are configured to require a client certificate
(mTLS).

  • failover.ssl.ssl_key_file (Optional)

A path to the client private SSL key file used by the coordinator.
Required if ssl_cert_file is set. Required if ssl_cert_file is set.

  • failover.ssl.ssl_ciphers (Optional)

A colon-separated (:) list of SSL cipher suites the connection can use.

  • failover.ssl.ssl_password (Optional)

A password for an encrypted private SSL key provided using
ssl_key_file. Alternatively, the password can be provided in
ssl_password_file.

  • failover.ssl.ssl_password_file (Optional)

A path to a text file with one or more passwords for encrypted private
SSL keys provided using ssl_key_file (each on a separate line).

Example:

failover:
  ssl:
    ssl_ca_file: './certs/rootCA.pem'
    ssl_cert_file: './certs/coordinator.crt'
    ssl_key_file: './certs/coordinator.key'
    # Optional:
    # ssl_ciphers: 'ECDHE-RSA-AES256-GCM-SHA384:...'
    # ssl_password: 'secret'
    # ssl_password_file: './certs/key_passwords.txt'

Requested by @Godrik0 in https://github.com/tarantool/tarantool-ee/commit/558a5399199095eddf21d85f72cec94090c65d65.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the existing documentation for failover coordinator configuration and its SSL or IPROTO connection settings. Add the failover.ssl section with the listed options, requirements, and YAML example from the issue. Done means the coordinator's SSL client-auth configuration is documented consistently with nearby configuration sections.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.