Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow mTLS for mysql storage backend #19400

Open
noltedennis opened this issue Feb 28, 2023 · 0 comments
Open

Allow mTLS for mysql storage backend #19400

noltedennis opened this issue Feb 28, 2023 · 0 comments

Comments

@noltedennis
Copy link

Is your feature request related to a problem? Please describe.
The MySQL storage backend supports SSL/TLS as of #439. The MySQL/MariaDB secrets engine in the meantime has been extended to support mTLS configuration. This was requested at least in #6444 and seems to have been implemented with #9181.
To me it appears odd that

  • the secrets engine supports mTLS, while the storage backend does not and
  • the TLS parameter names of secret engine and storage backend differ.

Describe the solution you'd like
I would hence like to propose that the storage backend is extended with similar options like the options of the secrets engine. If backwards compatibility allows for that, I'd also like to propose to adjust the options to a common naming scheme. I understand, however, that the latter might not be reasonable.

Describe alternatives you've considered
In our case we would prefer a mutual SSL/TLS database connection to the storage backend, because the Vault and database servers are not separated within a private network. Placing these two servers in their own private network might be advisable. In addition, #6444 mentions that one could make use of proxying instead.

Explain any additional use-cases
One could use certificate-based authentication once mTLS capabilities are established.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants