Skip to content

Commit

Permalink
Merge branch 'docs-special-week' into patch-15
Browse files Browse the repository at this point in the history
  • Loading branch information
pepezzzz authored May 26, 2020
2 parents dc0a00e + 432fefa commit a88a2fd
Show file tree
Hide file tree
Showing 150 changed files with 4,340 additions and 870 deletions.
26 changes: 16 additions & 10 deletions TOC.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,14 @@
+ 安装与启动
+ Linux
+ [使用 TiUP 部署](/production-deployment-using-tiup.md) @李仲舒
+ [使用 TiUP 离线部署](/production-deployment-using-tiup-offline.md) @刘金龙
+ [使用 TiUP 离线部署](/production-offline-deployment-using-tiup.md) @刘金龙
+ [使用 Ansible 部署](/online-deployment-using-ansible.md)
+ [使用 Ansible 离线部署](/offline-deployment-using-ansible.md)
+ [使用 Docker 部署](/test-deployment-using-docker.md)
+ Kubernetes
+ AWS
+ GCP
+ Alibaba Cloud
+ 监控与告警设置
+ [监控框架概述](/tidb-monitoring-framework.md) @李宋高
+ [监控 API](/tidb-monitoring-api.md) @李宋高
+ [测试验证](/post-installation-check.md) @李仲舒
+ 性能测试报告及重现指南
+ [如何用 Sysbench 测试 TiDB](/benchmark/benchmark-tidb-using-sysbench.md) @周跃跃
Expand Down Expand Up @@ -77,11 +74,16 @@
+ 使用 BR 工具
+ [使用 BR 进行备份与恢复](/br/backup-and-restore-tool.md) @栾成
+ [BR 备份与恢复场景示例](/br/backup-and-restore-use-cases.md) @栾成
+ [告警处理](/handle-alerts.md) @李宋高
+ [日常巡检](/daily-inspection.md) @王军
+ [TiCDC 任务管理](/ticdc/manage-ticdc.md) @沈泰宁
+ [TiUP 常用运维操作](/maintain-tidb-using-tiup.md) @王贤净
+ [TiFlash 常用运维操作](/tiflash/maintain-tiflash.md) @雷宇
+ 监控与告警
+ [监控框架概述](/tidb-monitoring-framework.md) @李宋高
+ [监控 API](/tidb-monitoring-api.md) @李宋高
+ [手动部署监控](/deploy-monitoring-services.md) @李宋高
+ [TiDB 集群报警规则与处理方法](/alert-rules.md) @李宋高
+ [TiFlash 报警规则与处理方法](/tiflash/tiflash-alert-rules.md) @孙若曦
+ 故障诊断
+ 硬件故障 @周强
+ [整机](/troubleshoot-machine-issues.md)
Expand Down Expand Up @@ -215,12 +217,10 @@
+ [PD 面板](/grafana-pd-dashboard.md) @PD Team/陈书宁
+ [TiKV 面板](/grafana-tikv-dashboard.md) @刘新韬
+ [TiFlash 监控指标](/tiflash/monitor-tiflash.md) @孙若曦
+ 告警信息
+ [TiDB 集群报警规则与处理方法](/alert-rules.md)
+ [TiFlash 报警规则与处理方法](/tiflash/tiflash-alert-rules.md) @孙若曦
+ 安全加固
+ [使用 TLS 加密连接](/encrypted-connections-with-tls-protocols.md) @苏立
+ [为 TiDB 组件间开启 TLS 和数据加密存储](/enable-tls-between-components.md) @苏立
+ [为 TiDB 客户端服务端间通信开启加密传输](/enable-tls-between-clients.md) @苏立
+ [为 TiDB 组件间通信开启加密传输](/enable-tls-between-components.md) @苏立
+ [为 TiDB 开启数据加密存储](/enable-encrypt-stored-data.md) @苏立
+ [生成自签名证书](/generate-self-signed-certificates.md) @刘新韬
+ 权限
+ [与 MySQL 安全特性差异](/security-compatibility-with-mysql.md) @毛康力
Expand Down Expand Up @@ -250,6 +250,7 @@
- [`ANALYZE TABLE`](/sql-statements/sql-statement-analyze-table.md)
- [`BEGIN`](/sql-statements/sql-statement-begin.md)
- [`COMMIT`](/sql-statements/sql-statement-commit.md)
- [`CREATE BINDING`](/sql-statements/sql-statement-create-binding.md)
- [`CREATE DATABASE`](/sql-statements/sql-statement-create-database.md)
- [`CREATE INDEX`](/sql-statements/sql-statement-create-index.md)
- [`CREATE SEQUENCE`](/sql-statements/sql-statement-create-sequence.md)
Expand All @@ -262,10 +263,12 @@
- [`DESC`](/sql-statements/sql-statement-desc.md)
- [`DESCRIBE`](/sql-statements/sql-statement-describe.md)
- [`DO`](/sql-statements/sql-statement-do.md)
- [`DROP BINDING`](/sql-statements/sql-statement-drop-binding.md)
- [`DROP COLUMN`](/sql-statements/sql-statement-drop-column.md)
- [`DROP DATABASE`](/sql-statements/sql-statement-drop-database.md)
- [`DROP INDEX`](/sql-statements/sql-statement-drop-index.md)
- [`DROP SEQUENCE`](/sql-statements/sql-statement-drop-sequence.md)
- [`DROP STATS`](/sql-statements/sql-statement-drop-stats.md)
- [`DROP TABLE`](/sql-statements/sql-statement-drop-table.md)
- [`DROP USER`](/sql-statements/sql-statement-drop-user.md)
- [`DROP VIEW`](/sql-statements/sql-statement-drop-view.md)
Expand Down Expand Up @@ -293,6 +296,8 @@
- [`SET PASSWORD`](/sql-statements/sql-statement-set-password.md)
- [`SET TRANSACTION`](/sql-statements/sql-statement-set-transaction.md)
- [`SET [GLOBAL|SESSION] <variable>`](/sql-statements/sql-statement-set-variable.md)
- [`SHOW ANALYZE STATUS`](/sql-statements/sql-statement-show-analyze-status.md)
- [`SHOW BINDINGS`](/sql-statements/sql-statement-show-bindings.md)
- [`SHOW BUILTINS`](/sql-statements/sql-statement-show-builtins.md)
- [`SHOW CHARACTER SET`](/sql-statements/sql-statement-show-character-set.md)
- [`SHOW COLLATION`](/sql-statements/sql-statement-show-collation.md)
Expand All @@ -305,6 +310,7 @@
- [`SHOW ERRORS`](/sql-statements/sql-statement-show-errors.md)
- [`SHOW [FULL] FIELDS FROM`](/sql-statements/sql-statement-show-fields-from.md)
- [`SHOW GRANTS`](/sql-statements/sql-statement-show-grants.md)
- [`SHOW STATS_META`](/sql-statements/sql-statement-show-stats-meta.md)
- [`SHOW INDEXES [FROM|IN]`](/sql-statements/sql-statement-show-indexes.md)
- [`SHOW INDEX [FROM|IN]`](/sql-statements/sql-statement-show-index.md)
- [`SHOW KEYS [FROM|IN]`](/sql-statements/sql-statement-show-keys.md)
Expand Down
14 changes: 3 additions & 11 deletions certificate-authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ category: reference
aliases: ['/docs-cn/dev/reference/security/cert-based-authentication/']
---

# TiDB 证书鉴权使用指南 <span class="version-mark">从 v3.0.8 版本开始引入</span>
# TiDB 证书鉴权使用指南

从 TiDB 3.0.8 版本开始,TiDB 支持基于证书鉴权的登录方式。采用这种方式,TiDB 对不同用户签发证书,使用加密连接来传输数据,并在用户登录时验证证书。相比 MySQL 用户常用的用户名密码验证方式,与 MySQL 相兼容的证书鉴权方式更安全,因此越来越多的用户使用证书鉴权来代替用户名密码验证。
TiDB 支持基于证书鉴权的登录方式。采用这种方式,TiDB 对不同用户签发证书,使用加密连接来传输数据,并在用户登录时验证证书。相比 MySQL 用户常用的用户名密码验证方式,与 MySQL 相兼容的证书鉴权方式更安全,因此越来越多的用户使用证书鉴权来代替用户名密码验证。

在 TiDB 上使用证书鉴权的登录方法,可能需要进行以下操作:

Expand All @@ -20,15 +20,7 @@ aliases: ['/docs-cn/dev/reference/security/cert-based-authentication/']

## 创建安全密钥和证书

### 安装 OpenSSL

目前推荐使用 [OpenSSL](https://www.openssl.org/) 来生成密钥和证书。以 Debian 操作系统为例,先执行以下命令来安装 OpenSSL:

{{< copyable "shell-regular" >}}

```bash
sudo apt-get install openssl
```
目前推荐使用 [OpenSSL](https://www.openssl.org/) 来生成密钥和证书,生成证书的过程和[为 TiDB 客户端服务端间通信开启加密传输](/enable-tls-between-clients.md)过程类似,下面更多演示如何在证书中配置更多需校验的属性字段。

### 生成 CA 密钥和证书

Expand Down
126 changes: 126 additions & 0 deletions config-templates/complex-cdc.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,126 @@
# # Global variables are applied to all deployments and used as the default value of
# # the deployments if a specific deployment value is missing.
global:
user: "tidb"
ssh_port: 22
deploy_dir: "/tidb-deploy"
data_dir: "/tidb-data"

# # Monitored variables are applied to all the machines.
monitored:
node_exporter_port: 9100
blackbox_exporter_port: 9115
# deploy_dir: "/tidb-deploy/monitored-9100"
# data_dir: "/tidb-data/monitored-9100"
# log_dir: "/tidb-deploy/monitored-9100/log"

# # Server configs are used to specify the runtime configuration of TiDB components.
# # All configuration items can be found in TiDB docs:
# # - TiDB: https://pingcap.com/docs/stable/reference/configuration/tidb-server/configuration-file/
# # - TiKV: https://pingcap.com/docs/stable/reference/configuration/tikv-server/configuration-file/
# # - PD: https://pingcap.com/docs/stable/reference/configuration/pd-server/configuration-file/
# # All configuration items use points to represent the hierarchy, e.g:
# # readpool.storage.use-unified-pool
# #
# # You can overwrite this configuration via the instance-level `config` field.

server_configs:
tidb:
log.slow-threshold: 300
tikv:
# server.grpc-concurrency: 4
# raftstore.apply-pool-size: 2
# raftstore.store-pool-size: 2
# rocksdb.max-sub-compactions: 1
# storage.block-cache.capacity: "16GB"
# readpool.unified.max-thread-count: 12
readpool.storage.use-unified-pool: false
readpool.coprocessor.use-unified-pool: true
pd:
schedule.leader-schedule-limit: 4
schedule.region-schedule-limit: 2048
schedule.replica-schedule-limit: 64

pd_servers:
- host: 10.0.1.4
# ssh_port: 22
# name: "pd-1"
# client_port: 2379
# peer_port: 2380
# deploy_dir: "/tidb-deploy/pd-2379"
# data_dir: "/tidb-data/pd-2379"
# log_dir: "/tidb-deploy/pd-2379/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.pd` values.
# config:
# schedule.max-merge-region-size: 20
# schedule.max-merge-region-keys: 200000
- host: 10.0.1.5
- host: 10.0.1.6

tidb_servers:
- host: 10.0.1.1
# ssh_port: 22
# port: 4000
# status_port: 10080
# deploy_dir: "/tidb-deploy/tidb-4000"
# log_dir: "/tidb-deploy/tidb-4000/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.tidb` values.
# config:
# log.slow-query-file: tidb-slow-overwrited.log
- host: 10.0.1.2
- host: 10.0.1.3

tikv_servers:
- host: 10.0.1.7
# ssh_port: 22
# port: 20160
# status_port: 20180
# deploy_dir: "/tidb-deploy/tikv-20160"
# data_dir: "/tidb-data/tikv-20160"
# log_dir: "/tidb-deploy/tikv-20160/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.tikv` values.
# config:
# server.grpc-concurrency: 4
# server.labels: { zone: "zone1", dc: "dc1", host: "host1" }

- host: 10.0.1.8
- host: 10.0.1.9

cdc_servers:
- host: 10.0.1.1
port: 8300
deploy_dir: "/tidb-deploy/cdc-8300"
log_dir: "/tidb-deploy/cdc-8300/log"
- host: 10.0.1.2
port: 8300
deploy_dir: "/tidb-deploy/cdc-8300"
log_dir: "/tidb-deploy/cdc-8300/log"
- host: 10.0.1.3
port: 8300
deploy_dir: "/tidb-deploy/cdc-8300"
log_dir: "/tidb-deploy/cdc-8300/log"

monitoring_servers:
- host: 10.0.1.10
# ssh_port: 22
# port: 9090
# deploy_dir: "/tidb-deploy/prometheus-8249"
# data_dir: "/tidb-data/prometheus-8249"
# log_dir: "/tidb-deploy/prometheus-8249/log"

grafana_servers:
- host: 10.0.1.10
# port: 3000
# deploy_dir: /tidb-deploy/grafana-3000

alertmanager_servers:
- host: 10.0.1.10
# ssh_port: 22
# web_port: 9093
# cluster_port: 9094
# deploy_dir: "/tidb-deploy/alertmanager-9093"
# data_dir: "/tidb-data/alertmanager-9093"
# log_dir: "/tidb-deploy/alertmanager-9093/log"
113 changes: 113 additions & 0 deletions config-templates/complex-mini.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
# # Global variables are applied to all deployments and used as the default value of
# # the deployments if a specific deployment value is missing.
global:
user: "tidb"
ssh_port: 22
deploy_dir: "/tidb-deploy"
data_dir: "/tidb-data"

# # Monitored variables are applied to all the machines.
monitored:
node_exporter_port: 9100
blackbox_exporter_port: 9115
# deploy_dir: "/tidb-deploy/monitored-9100"
# data_dir: "/tidb-data/monitored-9100"
# log_dir: "/tidb-deploy/monitored-9100/log"

# # Server configs are used to specify the runtime configuration of TiDB components.
# # All configuration items can be found in TiDB docs:
# # - TiDB: https://pingcap.com/docs/stable/reference/configuration/tidb-server/configuration-file/
# # - TiKV: https://pingcap.com/docs/stable/reference/configuration/tikv-server/configuration-file/
# # - PD: https://pingcap.com/docs/stable/reference/configuration/pd-server/configuration-file/
# # All configuration items use points to represent the hierarchy, e.g:
# # readpool.storage.use-unified-pool
# #
# # You can overwrite this configuration via the instance-level `config` field.

server_configs:
tidb:
log.slow-threshold: 300
binlog.enable: false
binlog.ignore-error: false
tikv:
# server.grpc-concurrency: 4
# raftstore.apply-pool-size: 2
# raftstore.store-pool-size: 2
# rocksdb.max-sub-compactions: 1
# storage.block-cache.capacity: "16GB"
# readpool.unified.max-thread-count: 12
readpool.storage.use-unified-pool: false
readpool.coprocessor.use-unified-pool: true
pd:
schedule.leader-schedule-limit: 4
schedule.region-schedule-limit: 2048
schedule.replica-schedule-limit: 64

pd_servers:
- host: 10.0.1.4
# ssh_port: 22
# name: "pd-1"
# client_port: 2379
# peer_port: 2380
# deploy_dir: "/tidb-deploy/pd-2379"
# data_dir: "/tidb-data/pd-2379"
# log_dir: "/tidb-deploy/pd-2379/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.pd` values.
# config:
# schedule.max-merge-region-size: 20
# schedule.max-merge-region-keys: 200000
- host: 10.0.1.5
- host: 10.0.1.6

tidb_servers:
- host: 10.0.1.1
# ssh_port: 22
# port: 4000
# status_port: 10080
# deploy_dir: "/tidb-deploy/tidb-4000"
# log_dir: "/tidb-deploy/tidb-4000/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.tidb` values.
# config:
# log.slow-query-file: tidb-slow-overwrited.log
- host: 10.0.1.2
- host: 10.0.1.3

tikv_servers:
- host: 10.0.1.7
# ssh_port: 22
# port: 20160
# status_port: 20180
# deploy_dir: "/tidb-deploy/tikv-20160"
# data_dir: "/tidb-data/tikv-20160"
# log_dir: "/tidb-deploy/tikv-20160/log"
# numa_node: "0,1"
# # The following configs are used to overwrite the `server_configs.tikv` values.
# config:
# server.grpc-concurrency: 4
# server.labels: { zone: "zone1", dc: "dc1", host: "host1" }
- host: 10.0.1.8
- host: 10.0.1.9

monitoring_servers:
- host: 10.0.1.10
# ssh_port: 22
# port: 9090
# deploy_dir: "/tidb-deploy/prometheus-8249"
# data_dir: "/tidb-data/prometheus-8249"
# log_dir: "/tidb-deploy/prometheus-8249/log"

grafana_servers:
- host: 10.0.1.10
# port: 3000
# deploy_dir: /tidb-deploy/grafana-3000

alertmanager_servers:
- host: 10.0.1.10
# ssh_port: 22
# web_port: 9093
# cluster_port: 9094
# deploy_dir: "/tidb-deploy/alertmanager-9093"
# data_dir: "/tidb-data/alertmanager-9093"
# log_dir: "/tidb-deploy/alertmanager-9093/log"
Loading

0 comments on commit a88a2fd

Please sign in to comment.