Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add TiFlash security configuration #5094

Merged
merged 6 commits into from
Dec 18, 2020
Merged

Add TiFlash security configuration #5094

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0f52ad5
Add configuration
JaySon-Huang Dec 15, 2020
35232d5
Apply suggestions from code review
JaySon-Huang Dec 15, 2020
330773b
Merge branch 'master' into tiflash_redact
TomShawn Dec 15, 2020
29d61b0
Apply suggestions from code review
JaySon-Huang Dec 16, 2020
30967d2
Apply suggestions from code review
JaySon-Huang Dec 18, 2020
426092e
Merge branch 'master' into tiflash_redact
TomShawn Dec 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions tiflash/tiflash-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,19 @@ delta_index_cache_size = 0 # DeltaIndex 内存 cache 大小限制，默认为 0
dt_enable_logical_split = true # 存储引擎的 segment 分裂是否使用逻辑分裂。使用逻辑分裂可以减小写放大，提高写入速度，但是会造成一定的空间浪费。默认为 true
max_memory_usage = 0 # 单次 coprocessor 查询过程中，对中间数据的内存限制，单位为 byte，默认为 0，表示不限制
max_memory_usage_for_all_queries = 0 # 所有查询过程中，对中间数据的内存限制，单位为 byte，默认为 0，表示不限制

## 安全相关配置，从 v4.0.5 开始生效
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里提到从 v4.0.5 开始生效，PR 是否需要 cherry-pick 到 release-4.0 呢？

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

也钩上了 pick 到 4.0。
redact_info_log 这个配置项暂时没有进 v4.0.9 的版本中。pick 4.0 的时候暂时先不加这个配置项。

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

可以 pick 到 4.0 后再删掉 redact_info_log，以后再加上？

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

嗯，是的。

[security]
## 若开启该选项，日志中的用户数据会以 `?` 代替显示
## 注意，tiflash-learner 对应的安全配置选项为 `security.redact-info-log`，需要在 tiflash-learner.toml 中另外开启
# redact_info_log = false

## 包含可信 SSL CA 列表的文件路径。如果你设置了该值，`cert_path` 和 `key_path` 中的路径也需要填写
# ca_path = "/path/to/ca.pem"
## 包含 PEM 格式的 X509 certificate 文件路径
# cert_path = "/path/to/tiflash-server.pem"
## 包含 PEM 格式的 X509 key 文件路径
# key_path = "/path/to/tiflash-server-key.pem"
```

### 配置文件 tiflash-learner.toml
Expand Down