Skip to content

Pass SSL config when checking connection to external mysql instance #18481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Pass SSL config when checking connection to external mysql instance #18481

wants to merge 4 commits into from
+638 −0

Conversation

chrisplim
Copy link

Description

When connecting to an external mysql instance, vttablet performs a connectivity check. That connectivity check doesn't pass through any SSL configuration to the connect logic so if the external mysql instance requires secure connections, then an error is thrown from mysql, preventing the vttablet from starting.

This PR addresses the issue by passing through the SSL configuration to the connect logic.

Related Issue(s)

Fixes: #18480

Checklist

  • "Backport to:" labels have been added if this change should be back-ported to release branches
  • If this change is to be back-ported to previous releases, a justification is included in the PR description
  • Tests were added or are not required
  • Did the new or modified tests pass consistently locally and on CI?
  • Documentation was added or is not required

Deployment Notes

@vitess-bot vitess-bot
Copy link
Contributor

vitess-bot bot commented Jul 24, 2025

Review Checklist

Hello reviewers! 👋 Please follow this checklist when reviewing this Pull Request.

General

  • Ensure that the Pull Request has a descriptive title.
  • Ensure there is a link to an issue (except for internal cleanup and flaky test fixes), new features should have an RFC that documents use cases and test cases.

Tests

  • Bug fixes should have at least one unit or end-to-end test, enhancement and new features should have a sufficient number of tests.

Documentation

  • Apply the release notes (needs details) label if users need to know about this change.
  • New features should be documented.
  • There should be some code comments as to why things are implemented the way they are.
  • There should be a comment at the top of each new or modified test to explain what the test does.

New flags

  • Is this flag really necessary?
  • Flag names must be clear and intuitive, use dashes (-), and have a clear help text.

If a workflow is added or modified:

  • Each item in Jobs should be named in order to mark it as required.
  • If the workflow needs to be marked as required, the maintainer team must be notified.

Backward compatibility

  • Protobuf changes should be wire-compatible.
  • Changes to _vt tables and RPCs need to be backward compatible.
  • RPC changes should be compatible with vitess-operator
  • If a flag is removed, then it should also be removed from vitess-operator and arewefastyet, if used there.
  • vtctl command output order should be stable and awk-able.

@vitess-bot vitess-bot bot added NeedsBackportReason If backport labels have been applied to a PR, a justification is required NeedsDescriptionUpdate The description is not clear or comprehensive enough, and needs work NeedsIssue A linked issue is missing for this Pull Request NeedsWebsiteDocsUpdate What it says labels Jul 24, 2025
@github-actions github-actions bot added this to the v23.0.0 milestone Jul 24, 2025
@dbussink
Copy link
Contributor

@chrisplim Are you able to add a test for this as well?

@codecov Codecov
Copy link

codecov bot commented Jul 24, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.48%. Comparing base (7dd3c6b) to head (0207260).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #18481      +/-   ##
==========================================
- Coverage   67.50%   67.48%   -0.02%     
==========================================
  Files        1607     1607              
  Lines      263093   263102       +9     
==========================================
- Hits       177593   177554      -39     
- Misses      85500    85548      +48

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@chrisplim
Copy link
Author

@dbussink I'll write one today

@chrisplim
Copy link
Author

@dbussink Hi, I was planning on making an endtoend test for this. Is there some existing test that I can use some existing patterns and fixtures from? It seems like there's no test that sets up an external mysql instance requiring SSL connections.

@chrisplim chrisplim force-pushed the chrislim/fix-vttablet-connect-to-unmanaged-mysql-ssl branch from 261abf0 to ea3ed2e Compare August 7, 2025 15:45
@chrisplim
Copy link
Author

@dbussink Added an endtoend test

dbussink
dbussink reviewed Aug 11, 2025
View reviewed changes
go/test/endtoend/encryption/unmanaged_mysql_ssl_test.go
// 2. When a MySQL instance does require SSL connections and SSL config is configured in the TabletConfig DB config, there's no error
// 3. When a MySQL instance does not require SSL connections, and no SSL config is configured in the TabletConfig DB config, there's no error
// 4. When a MySQL instance does require SSL connections, but no SSL config is configured in the TabletConfig DB config, there's an error
func TestUnmanagedMysqlSSLConnection(t *testing.T) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might have to guard these new tests with a version check, since we also run endtoend tests against older versions for compatibility checks but that would fail here then.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

dbussink
dbussink reviewed Sep 2, 2025
View reviewed changes
go/test/endtoend/encryption/unmanaged_mysql_ssl_test.go
// when creating the mysql.ConnParams structure and calling mysql.Connect
})
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chrisplim Do we really need all the things from this test? Can we create a much more focussed test on the actual issue here instead?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to be thorough in testing the different scenarios of my change. I need some help in what a good, focused test would be.

Can you please be a bit more specific in what I should be changing?

  • Should I reduce the number of test scenarios down to only these?

    • // 2. When a MySQL instance does require SSL connections and SSL config is configured in the TabletConfig DB config, there's no error
      // 4. When a MySQL instance does require SSL connections, but no SSL config is configured in the TabletConfig DB config, there's an error

  • Should I be setting up the test a different way?

  • Other things?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This honestly looks like a lot of AI generated tests, and my experience generally is that you really have to cut that down to the core of what it needs.

What we need to check here is if we have SSL on the TableConfig, it connects to MySQL with that. Let's focus purely on that change.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, will pare down the tests to just

When a MySQL instance does require SSL connections and SSL config is configured in the TabletConfig DB config, there's no error

@chrisplim chrisplim mentioned this pull request Sep 2, 2025
Open
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dbussink dbussink dbussink left review comments

@harshit-gangal harshit-gangal Awaiting requested review from harshit-gangal harshit-gangal is a code owner

@systay systay Awaiting requested review from systay systay is a code owner

@shlomi-noach shlomi-noach Awaiting requested review from shlomi-noach shlomi-noach is a code owner

@rohit-nayak-ps rohit-nayak-ps Awaiting requested review from rohit-nayak-ps rohit-nayak-ps is a code owner

@timvaillancourt timvaillancourt Awaiting requested review from timvaillancourt timvaillancourt is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

@arthurschreiber arthurschreiber

@dbussink dbussink

Labels
NeedsBackportReason If backport labels have been applied to a PR, a justification is required NeedsDescriptionUpdate The description is not clear or comprehensive enough, and needs work NeedsIssue A linked issue is missing for this Pull Request NeedsWebsiteDocsUpdate What it says
Projects
None yet
Milestone
v23.0.0
Development

Successfully merging this pull request may close these issues.

Bug Report: SSL config not used when checking externally managed mysql.
3 participants
@chrisplim @dbussink @arthurschreiber