replace the tls layer in config key path with flat key names - #337
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates Cassandra/Yugabyte TLS configuration handling to use flat tls_* keys (instead of a nested tls { ... } block) and introduces an optional tls_server_name for SNI/hostname override during TLS handshakes.
Changes:
- Switch Cassandra/Yugabyte TLS config lookups from
tls.*to flattls_*keys. - Pass
tls_insecure_skip_verifyinto the TLS config loader instead of reading it inside the helper. - Add support for configuring
tls_server_nameintotls.Config.ServerName.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| db/cassandra/cassandra_client.go | Reads flat TLS keys for Cassandra/Yugabyte connections and wires tls_server_name into tls.Config. |
| config/sample_webconfig.conf | Updates sample config to use flat tls_* keys and documents tls_server_name. |
Suppressed comments (2)
db/cassandra/cassandra_client.go:200
- The function comment says it reads only flat
tls_*keys, but the overall configuration API has historically supported nestedtls.*keys. If you add backward-compatible fallback support, please update this comment to reflect that both formats are accepted.
// Reads flat tls_* keys directly under the database driver config (cassandra or yugabyte).
db/cassandra/cassandra_client.go:206
- Only the new flat TLS key names are read here (
tls_cert_file, etc.). If a deployment still uses the legacy nestedtls { ... }block (tls.cert_file, etc.), cert/CA paths will be missed and TLS will be misconfigured. Consider supporting both key paths (new flat keys with fallback to legacy dotted keys) for a smoother migration.
// Load client certificates for mTLS if provided (optional when insecure_skip_verify is true)
certFile := dbconf.GetString("tls_cert_file")
keyFile := dbconf.GetString("tls_key_file")
caCertFile := dbconf.GetString("tls_ca_cert_file")
serverName := dbconf.GetString("tls_server_name")
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
147
to
150
| if isSslEnabled { | ||
| tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver) | ||
| insecureSkipVerify := dbconf.GetBoolean("tls_insecure_skip_verify") | ||
| tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver, insecureSkipVerify) | ||
| if err != nil { |
Comment on lines
+201
to
+206
| func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string, insecureSkipVerify bool) (*tls.Config, error) { | ||
| // Load client certificates for mTLS if provided (optional when insecure_skip_verify is true) | ||
| certFile := dbconf.GetString("tls.cert_file") | ||
| keyFile := dbconf.GetString("tls.key_file") | ||
| caCertFile := dbconf.GetString("tls.ca_cert_file") | ||
| certFile := dbconf.GetString("tls_cert_file") | ||
| keyFile := dbconf.GetString("tls_key_file") | ||
| caCertFile := dbconf.GetString("tls_ca_cert_file") | ||
| serverName := dbconf.GetString("tls_server_name") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.