Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set PD Dashboard Config when TLS Client enabled #2085

Merged
merged 10 commits into from
Apr 7, 2020
Merged

Set PD Dashboard Config when TLS Client enabled #2085

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
561f9ed
support pd dashboard config
weekface Mar 31, 2020
ea257d3
Merge branch 'master' into pd-dashboard-config
weekface Mar 31, 2020
86d2550
Update pkg/manager/member/pd_member_manager.go
weekface Mar 31, 2020
a14dbaa
Merge branch 'master' into pd-dashboard-config
weekface Apr 2, 2020
966b99a
fix ci
weekface Apr 2, 2020
60c7443
Merge branch 'pd-dashboard-config' of https://github.com/weekface/tid…
weekface Apr 2, 2020
51b6dd5
address comment
weekface Apr 3, 2020
76c7d41
Merge branch 'master' into pd-dashboard-config
weekface Apr 7, 2020
079c501
Merge branch 'master' into pd-dashboard-config
weekface Apr 7, 2020
912ab2e
Merge branch 'master' into pd-dashboard-config
sre-bot Apr 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions docs/api-references/docs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2894,6 +2894,55 @@ CrdKind
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.DashboardConfig">DashboardConfig
</h3>
<p>
(<em>Appears on:</em>
<a href="#pingcap.com/v1alpha1.PDConfig">PDConfig</a>)
</p>
<p>
<p>DashboardConfig is the configuration for tidb-dashboard.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>tidb_cacert_path</code></br>
<em>
string
</em>
</td>
<td>
</td>
</tr>
<tr>
<td>
<code>tidb_cert_path</code></br>
<em>
string
</em>
</td>
<td>
</td>
</tr>
<tr>
<td>
<code>tidb_key_path</code></br>
<em>
string
</em>
</td>
<td>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.Experimental">Experimental
</h3>
<p>
Expand Down Expand Up @@ -4104,6 +4153,19 @@ namespaces.
Optional: Defaults to true</p>
</td>
</tr>
<tr>
<td>
<code>dashboard</code></br>
<em>
<a href="#pingcap.com/v1alpha1.DashboardConfig">
DashboardConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
</td>
</tr>
</tbody>
</table>
<h3 id="pingcap.com/v1alpha1.PDFailureMember">PDFailureMember
Expand Down
21 changes: 21 additions & 0 deletions examples/selfsigned-tls/tidb-client-cert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: tidb-client-cert
spec:
secretName: tls-tidb-client-secret # <cluster>-tidb-client-secret
subject:
organizationalUnits:
- "TiDB Operator"
organization:
- "PingCAP"
duration: "8760h" # 364 days
# If you want verify server cert Common Name (e.g. --ssl-verify-server-cert
# flag in MySQL CLI), you must configure the HostName you used to connect the
# server here.
commonName: "tls-tidb-client"
usages:
- "client auth"
issuerRef:
name: selfsigned-cert-issuer
kind: Issuer
1 change: 1 addition & 0 deletions manifests/crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1344,6 +1344,7 @@ spec:
type: string
cluster-version:
type: string
dashboard: {}
election-interval:
description: ElectionInterval is the interval for etcd Raft
election.
Expand Down
7 changes: 6 additions & 1 deletion pkg/apis/pingcap/v1alpha1/openapi_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 10 additions & 0 deletions pkg/apis/pingcap/v1alpha1/pd_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,16 @@ type PDConfig struct {
// Optional: Defaults to true
// +optional
NamespaceClassifier string `toml:"namespace-classifier,omitempty" json:"namespace-classifier,omitempty"`

// +optional
Dashboard *DashboardConfig `toml:"dashboard,omitempty" json:"dashboard,omitempty"`
}

// DashboardConfig is the configuration for tidb-dashboard.
type DashboardConfig struct {
TiDBCAPath string `toml:"tidb-cacert-path,omitempty" json:"tidb_cacert_path,omitempty"`
TiDBCertPath string `toml:"tidb-cert-path,omitempty" json:"tidb_cert_path,omitempty"`
TiDBKeyPath string `toml:"tidb-key-path,omitempty" json:"tidb_key_path,omitempty"`
}

// PDLogConfig serializes log related config in toml/json.
Expand Down
21 changes: 21 additions & 0 deletions pkg/apis/pingcap/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

25 changes: 24 additions & 1 deletion pkg/manager/member/pd_member_manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ import (

const (
// pdClusterCertPath is where the cert for inter-cluster communication stored (if any)
pdClusterCertPath = "/var/lib/pd-tls"
pdClusterCertPath = "/var/lib/pd-tls"
tidbClientCertPath = "/var/lib/tidb-client-tls"
)

type pdMemberManager struct {
Expand Down Expand Up @@ -513,6 +514,11 @@ func getNewPDSetForTidbCluster(tc *v1alpha1.TidbCluster, cm *corev1.ConfigMap) (
Name: "pd-tls", ReadOnly: true, MountPath: "/var/lib/pd-tls",
})
}
if tc.Spec.TiDB.IsTLSClientEnabled() {
volMounts = append(volMounts, corev1.VolumeMount{
Name: "tidb-client-tls", ReadOnly: true, MountPath: tidbClientCertPath,
})
}

vols := []corev1.Volume{
annVolume,
Expand Down Expand Up @@ -546,6 +552,15 @@ func getNewPDSetForTidbCluster(tc *v1alpha1.TidbCluster, cm *corev1.ConfigMap) (
},
})
}
if tc.Spec.TiDB.IsTLSClientEnabled() {
vols = append(vols, corev1.Volume{
Name: "tidb-client-tls", VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: util.TiDBClientTLSSecretName(tc.Name),
},
},
})
}

storageRequest, err := controller.ParseStorageRequest(tc.Spec.PD.Requests)
if err != nil {
Expand Down Expand Up @@ -688,6 +703,14 @@ func getPDConfigMap(tc *v1alpha1.TidbCluster) (*corev1.ConfigMap, error) {
config.Security.CertPath = path.Join(pdClusterCertPath, corev1.TLSCertKey)
config.Security.KeyPath = path.Join(pdClusterCertPath, corev1.TLSPrivateKeyKey)
}
if tc.Spec.TiDB.IsTLSClientEnabled() {
if config.Dashboard == nil {
config.Dashboard = &v1alpha1.DashboardConfig{}
}
config.Dashboard.TiDBCAPath = path.Join(tidbClientCertPath, tlsSecretRootCAKey)
config.Dashboard.TiDBCertPath = path.Join(tidbClientCertPath, corev1.TLSCertKey)
config.Dashboard.TiDBKeyPath = path.Join(tidbClientCertPath, corev1.TLSPrivateKeyKey)
}

confText, err := MarshalTOML(config)
if err != nil {
Expand Down