Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature/dao] cassandra authentication + client encryption #405

Merged
merged 3 commits into from
Aug 4, 2015

Conversation

thibaultcha
Copy link
Member

This PR addresses #373 (Cassandra authentication). Kong can now be used with any authenticated/encrypted Cassandra cluster (ie. instaclustr.com).

In order to do this and as an investment for Cassandra related features to move faster in the future, the Cassandra driver was switched from jbochi/lua-resty-cassandra to a new one, which supports both binary protocols v2 and v3, as well as authentication and client encryption.

Changes

  • Cassandra driver (lua-cassandra) now uses binary protocol v3. This in an investment in order to improve the DAO in the future, and use some of the new features provided by the v3 protocol (ie. named values binding).
  • Support for authentication (PasswordAuthenticator).
  • Support for client-to-node encryption.

The driver supports all those features for both Luasocket and OpenResty environments. For it to work in Kong, this is the changes one would have to make to their configuration file:

databases_available:
  cassandra:
  properties:
    ssl: true # for client-to-node encryption
    ssl_verify: true # if SSL verification
    ssl_certificate: "/path/to/cluster-ca-certificate.pem" # **absolute** path to the certificate authority file
    user: cassandra # user (and password) if the cluster has authentication enabled
    password: cassandra
    #  [...]

This makes Kong fully compatible with Cassandra provisioning services such as https://www.instaclustr.com.

I would recommend not merging this for the upcoming 0.4.0 since the switch of the underlying Cassandra driver is a potential breaking change. This could be part of an eventual 0.4.1 or 0.5.0 (in a shorter time span then 0.3.2 -> 0.4.0).

@thibaultcha thibaultcha added the pr/ready (but hold merge) No more concerns, but do not merge yet (probably a conflict of interest with another PR or release) label Jul 15, 2015
@thibaultcha thibaultcha force-pushed the feat/cassandra-auth branch 3 times, most recently from f974675 to 769e1ea Compare July 21, 2015 20:47
@thibaultcha thibaultcha changed the title [feature/dao] cassandra authentification + client encryption [feature/dao] cassandra authentication + client encryption Jul 30, 2015
Switch to lua-cassandra 0.3.3-0 and add some code to be able to use
authentication and SSL encryption to communicate with a Cassandra
cluster

Properties to add to the cassandra.properties settings:

ssl: true
ssl_verify: true
ssl_certificate: "/path/to/cluster-ca-certificate.pem"
user: cassandra
password: cassandra
@thibaultcha thibaultcha force-pushed the feat/cassandra-auth branch from 769e1ea to f0e9d7e Compare August 4, 2015 03:14
@thibaultcha
Copy link
Member Author

Merging this to start testing it + I'll need it for an upcoming fix about the DAO in plugins-migrations.

thibaultcha added a commit that referenced this pull request Aug 4, 2015
[feature/dao] cassandra authentication + client encryption
@thibaultcha thibaultcha merged commit 47d4493 into master Aug 4, 2015
@thibaultcha thibaultcha deleted the feat/cassandra-auth branch August 4, 2015 03:20
ctranxuan pushed a commit to streamdataio/kong that referenced this pull request Aug 25, 2015
[feature/dao] cassandra authentication + client encryption

Former-commit-id: 24397407beb1296088567ae389206d877e4e3ae7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pr/ready (but hold merge) No more concerns, but do not merge yet (probably a conflict of interest with another PR or release)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant