Fail to run k3s using mysql with SSL (... it doesn't contain any IP SANs) about kine HOT 10 OPEN

This may be related to go-sql-driver/mysql#564

from kine.

@brandond It's not related, that because if you want to connect to GCP mysql, you have to use dsn with ip (not with domain) and you have to manually pass the server name to tls config to let it verify by server name.

from kine.

Wait, so you're connecting to it with an IP address in the datastore URI, but want to validate the certificate against a hostname, because the IP address isn't in the SAN list on the server's cert?

Can you provide an example?

from kine.

@brandond yes it is.

See this commit for another project:

https://github.com/ajvb/kala/pull/211/files#diff-cdd396ae86656919264e05e2f781ed517f85aa8dd79c0cfe64ee1954bc98734eR209

I use config something like this:

{
  "jobDBAddress": "(123.123.123.123)/kala?tls=custom",
  "jobDBUsername": "user",
  "jobDBPassword": "the secret",
  "jobDBTlsServerName": "api-0000000000000-00000:blabla"
}

and it works perfectly

from kine.

that's how GCP mysql with TLS works 😂

from kine.

See this also:

https://stackoverflow.com/questions/53752383/how-do-you-create-a-tls-connection-to-a-cloud-sql-database-using-go

from kine.

So they basically require you to disable TLS verification because "the mysql client libraries by default have hostname verification disabled" and they seem to think that using unique self-signed certs makes MITM impossible somehow? This all seems quite broken.

from kine.

Well, to be honestly, I'm not familiar with MITM, and don't know why they made like that. I just want to use k3s with TLS mysql on GCP. All I know is there are 2 ways to solve this:

1. Let ?tls=skip-verify works (this is the way that we connect to server but skip that verification, like you said)
2. Pass ServerName to tls config to verify by server name (this is that we connect to it and verify the cert by the server name they request)

from kine.

Also hitting this.
I think the best option is to honor the tls=skip-verify flag since this is a classic and it might help in other reason than Google Cloud (if not the ssl lib won't have included it)

from kine.

For those that are affected by this one just want to share that using postgresql has not this side effect since pq does honor sslmode=verify-ca

from kine.