release-22.1: roachprod: support --secure flag for start-tenant #85719
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The in-development tenant streaming features require a secure tenant to test them properly. This change adds support for the --secure flag when starting a tenant. When passed, we use the host cluster to generate tenant-client certificates and distribute them to the tenant cluster, along with the CA and previously created client certificates. For simplicity, we've stuck with using a single CA for all certificate creation. Release note: None
|
Thanks for opening a backport. Please check the backport criteria before merging:
If some of the basic criteria cannot be satisfied, ensure that the exceptional criteria are satisfied within.
Add a brief release justification to the body of your PR to justify this backport. Some other things to consider:
|
|
This change is |
This PR updates the `acceptance/multitenant` and `multitenant-upgrade` roachtests to run in secure mode, now that the necessary infra. to run multitenant roachtests in secure mode has been added to roachprod. It also updates the roachprod setup to detect whether or not the cockroach binary supports tenant-scoped client certificates via the `--help` command's output. Release note: none
abarganier
requested review from
rimadeodhar,
jeffswenson,
rafiss and
stevendanna
|
Multitenant roachtest outputs with these changes: acceptance/multitenantmultitenant-upgrade |
|
TFTR! |
stevendanna
reviewed
Aug 9, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport 1/1 commits from #82248.
/cc @cockroachdb/release
The in-development tenant streaming features require a secure tenant
to test them properly.
This change adds support for the --secure flag when starting a
tenant. When passed, we use the host cluster to generate tenant-client
certificates and distribute them to the tenant cluster, along with the
CA and previously created client certificates.
For simplicity, we've stuck with using a single CA for all certificate
creation.
Release note: None
Backport notes
This PR is a follow up to a previous backport (#84371) which introduced functionality to support tenant scoped client certificates & authz checks into CockroachDB v22.1.
While #84371 successfully provided all the necessary changes within CockroachDB to support these new certificates, it failed to include some necessary roachprod changes (#82248) required to make use of these new certificates in roachprod/roachtests, and more generally, to run multitenant roachtests in
securemode.This led to roachtest failures on the
release-22.1branch (#85211). I've confirmed that the failing tests pass with the inclusion of #82248.Furthermore, with support for
securemultitenant roachtests, we no longer have to skip theacceptance/multitenantroachtest on therelease-22.1branch. This PR removes theSkipflag from the test registry foracceptance/multitenant.Lastly, it adds the
install.SecureOption(true)flag to the cluster settings used in the setup of themultitenant-upgradeandacceptance/multitenantroachtests.Release justification: fix for a roachtest failure marked as a release blocked for the
release-22.1branch.