k3s-io/kine

Fail to run k3s using mysql with SSL (... it doesn't contain any IP SANs)

up9cloud opened this issue · 11 comments

brandond commented

This may be related to go-sql-driver/mysql#564

up9cloud commented

@brandond It's not related, that because if you want to connect to GCP mysql, you have to use dsn with ip (not with domain) and you have to manually pass the server name to tls config to let it verify by server name.

brandond commented

Wait, so you're connecting to it with an IP address in the datastore URI, but want to validate the certificate against a hostname, because the IP address isn't in the SAN list on the server's cert?

Can you provide an example?

up9cloud commented

@brandond yes it is.

See this commit for another project:

https://github.com/ajvb/kala/pull/211/files#diff-cdd396ae86656919264e05e2f781ed517f85aa8dd79c0cfe64ee1954bc98734eR209

I use config something like this:

{
  "jobDBAddress": "(123.123.123.123)/kala?tls=custom",
  "jobDBUsername": "user",
  "jobDBPassword": "the secret",
  "jobDBTlsServerName": "api-0000000000000-00000:blabla"
}

and it works perfectly

up9cloud commented

that's how GCP mysql with TLS works 😂

brandond commented

So they basically require you to disable TLS verification because "the mysql client libraries by default have hostname verification disabled" and they seem to think that using unique self-signed certs makes MITM impossible somehow? This all seems quite broken.

up9cloud commented

Well, to be honestly, I'm not familiar with MITM, and don't know why they made like that. I just want to use k3s with TLS mysql on GCP. All I know is there are 2 ways to solve this:

  1. Let ?tls=skip-verify works (this is the way that we connect to server but skip that verification, like you said)
  2. Pass ServerName to tls config to verify by server name (this is that we connect to it and verify the cert by the server name they request)
fredleger commented

Also hitting this.
I think the best option is to honor the tls=skip-verify flag since this is a classic and it might help in other reason than Google Cloud (if not the ssl lib won't have included it)

fredleger commented

For those that are affected by this one just want to share that using postgresql has not this side effect since pq does honor sslmode=verify-ca