search

planetscale / vitess-operator

Kubernetes Operator for Vitess
Apache License 2.0
300 stars 74 forks source link

Pass `--mysql_clientcert_auth_method` flag to Vitess #507

Closed Tener closed 9 months ago

Tener commented 9 months ago

vitess-operator does not pass --mysql_clientcert_auth_method flag to Vitess. As a result, no client certificate subject verification is performed for MySQL and any user can connect as any other user, independently of the certificate subject, so long as the certificate used for connection is valid.

Tener commented 9 months ago

Looks like I've misunderstood the meaning for this flag; in practice it seems like without choosing clientcert auth method using --mysql_auth_server_impl=clientcert the certificate subject is ignored. I think this is worth documenting, but nonetheless this issue is invalid.