-
Notifications
You must be signed in to change notification settings - Fork 688
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cloud: add SQL and TiFlash related docs (#9001) #9479
Changes from all commits
05d5abf
d124d1e
1b47a7a
ed64eb8
0b04d72
d6946eb
0616aba
b025eaa
6cb5641
2943d4b
c7d12a1
3938998
fa66c84
925fc2d
97cf77c
40e7b79
6c0d22d
a1b3ce4
f02ead3
97231eb
36d4701
c80f949
20e5da3
90e1105
4b3b11d
5fa0452
f909e66
b053d3a
3cd8f50
1f451de
5595b1b
4e1b25e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -18,7 +18,17 @@ The rest of the document introduces in detail how to perform these operations. | |
|
||
## Create security keys and certificates | ||
|
||
It is recommended that you use [OpenSSL](https://www.openssl.org/) to create keys and certificates. The certificate generation process is similar to the process described in [Enable TLS Between TiDB Clients and Servers](/enable-tls-between-clients-and-servers.md). The following paragraphs demonstrate on how to configure more attribute fields that need to be verified in the certificate. | ||
<CustomContent platform="tidb"> | ||
|
||
It is recommended that you use [OpenSSL](https://www.openssl.org/) to create keys and certificates. The certificate generation process is similar to the process described in [Enable TLS Between TiDB Clients and Servers](/enable-tls-between-clients-and-servers.md). The following paragraphs demonstrate how to configure more attribute fields that need to be verified in the certificate. | ||
|
||
</CustomContent> | ||
|
||
<CustomContent platform="tidb-cloud"> | ||
|
||
It is recommended that you use [OpenSSL](https://www.openssl.org/) to create keys and certificates. The certificate generation process is similar to the process described in [Enable TLS Between TiDB Clients and Servers](https://docs.pingcap.com/tidb/stable/enable-tls-between-clients-and-servers). The following paragraphs demonstrate how to configure more attribute fields that need to be verified in the certificate. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Enable TLS Between TiDB Clients and Servers建议挪过来 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 安全相关的文档后续会根据后续安全相关的功能支持往文档里添加。 |
||
|
||
</CustomContent> | ||
|
||
### Generate CA key and certificate | ||
|
||
|
@@ -277,7 +287,7 @@ The user certificate information can be specified by `require subject`, `require | |
openssl x509 -noout -subject -in ca-cert.pem | sed 's/.\{8\}//' | sed 's/, /\//g' | sed 's/ = /=/g' | sed 's/^/\//' | ||
``` | ||
|
||
+ `require san`: Specifies the `Subject Alternative Name` information of the CA certificate that issues the user certificate. The information to be specified is consistent with the [`alt_names` of the `openssl.cnf` configuration file](/generate-self-signed-certificates.md) used to generate the client certificate. | ||
+ `require san`: Specifies the `Subject Alternative Name` information of the CA certificate that issues the user certificate. The information to be specified is consistent with the [`alt_names` of the `openssl.cnf` configuration file](https://docs.pingcap.com/tidb/stable/generate-self-signed-certificates) used to generate the client certificate. | ||
|
||
+ Execute the following command to get the information of the `require san` item in the generated certificate: | ||
|
||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -22,8 +22,18 @@ Currently, it is not supported to only enable encrypted transmission of some spe | |
|
||
You can use tools like `openssl`, `easy-rsa` and `cfssl` to generate self-signed certificates. | ||
|
||
<CustomContent platform="tidb"> | ||
|
||
If you choose `openssl`, you can refer to [generating self-signed certificates](/generate-self-signed-certificates.md). | ||
|
||
</CustomContent> | ||
|
||
<CustomContent platform="tidb-cloud"> | ||
|
||
If you choose `openssl`, you can refer to [generating self-signed certificates](https://docs.pingcap.com/tidb/stable/generate-self-signed-certificates). | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 这个文档应该可以挪过来? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 安全相关的文档后续会根据后续安全相关的功能支持往文档里添加。 |
||
|
||
</CustomContent> | ||
|
||
2. Configure certificates. | ||
|
||
To enable mutual authentication among TiDB components, configure the certificates of TiDB, TiKV, and PD as follows. | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
建议挪过来
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://docs.pingcap.com/tidb/stable/troubleshoot-hot-spot-issues 里 Identify hotspot issues 以及Dashboard 内容在 Cloud 上不适用,需要单独处理,我先记录下这个需求,计划在下一批次中处理。