You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
The MySQL storage backend supports SSL/TLS as of #439. The MySQL/MariaDB secrets engine in the meantime has been extended to support mTLS configuration. This was requested at least in #6444 and seems to have been implemented with #9181.
To me it appears odd that
the secrets engine supports mTLS, while the storage backend does not and
Describe the solution you'd like
I would hence like to propose that the storage backend is extended with similar options like the options of the secrets engine. If backwards compatibility allows for that, I'd also like to propose to adjust the options to a common naming scheme. I understand, however, that the latter might not be reasonable.
Describe alternatives you've considered
In our case we would prefer a mutual SSL/TLS database connection to the storage backend, because the Vault and database servers are not separated within a private network. Placing these two servers in their own private network might be advisable. In addition, #6444 mentions that one could make use of proxying instead.
Explain any additional use-cases
One could use certificate-based authentication once mTLS capabilities are established.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
The MySQL storage backend supports SSL/TLS as of #439. The MySQL/MariaDB secrets engine in the meantime has been extended to support mTLS configuration. This was requested at least in #6444 and seems to have been implemented with #9181.
To me it appears odd that
Describe the solution you'd like
I would hence like to propose that the storage backend is extended with similar options like the options of the secrets engine. If backwards compatibility allows for that, I'd also like to propose to adjust the options to a common naming scheme. I understand, however, that the latter might not be reasonable.
Describe alternatives you've considered
In our case we would prefer a mutual SSL/TLS database connection to the storage backend, because the Vault and database servers are not separated within a private network. Placing these two servers in their own private network might be advisable. In addition, #6444 mentions that one could make use of proxying instead.
Explain any additional use-cases
One could use certificate-based authentication once mTLS capabilities are established.
The text was updated successfully, but these errors were encountered: