Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add appProtocol to database headless-services #621

Open
sando38 opened this issue Apr 4, 2024 · 0 comments
Open

Add appProtocol to database headless-services #621

sando38 opened this issue Apr 4, 2024 · 0 comments

Comments

@sando38
Copy link

sando38 commented Apr 4, 2024

Proposal

Currently the operator creates a database headless-service with roughly these configs:

apiVersion: v1
kind: Service
metadata:
  name: database-pxc-db-pxc
spec:
  ports:
    - name: mysql
      protocol: TCP
      port: 3306
      targetPort: 3306
    - name: mysql-admin
      protocol: TCP
      port: 33062
      targetPort: 33062
    - name: mysqlx
      protocol: TCP
      port: 33060
      targetPort: 33060
...

Like in percona/percona-server-mongodb-operator#1393 when using Istio and mTLS, istio cannot correctly interpret the protocol, hence Istio's mTLS does not work.

The following service works with Istio's mTLS enabled:

apiVersion: v1
kind: Service
metadata:
  name: database-pxc-db-pxc
spec:
  ports:
    - name: mysql
      protocol: TCP
      port: 3306
      targetPort: 3306
    - name: mysql-admin
      protocol: TCP
      port: 33062
      targetPort: 33062
    - name: mysqlx
      protocol: TCP
      port: 33060
      targetPort: 33060
    - name: sst
      protocol: TCP
      appProtocol: tcp
      port: 4444
      targetPort: 4444
    - name: write-set
      protocol: TCP
      appProtocol: tcp
      port: 4567
      targetPort: 4567
    - name: ist
      protocol: TCP
      appProtocol: tcp
      port: 4568
      targetPort: 4568
...

Compared to the mongo implementation, we would need to set appProtocol: tcp.

Use-Case

Istio with mTLS enabled.

Is this a feature you are interested in implementing yourself?

No

Anything else?

Thank you for considering to implement it 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant