[database] Add TLS support for database connections

cmd/config/app_config_test.go

@@ -34,18 +34,18 @@ import (
 var (
 	defaultServerTLSConfig = connection.TLSConfig{
 		Mode:     connection.MutualTLSMode,
-		CertPath: "/server-certs/public-key",
-		KeyPath:  "/server-certs/private-key",
+		CertPath: "/server-certs/public-key.pem",
+		KeyPath:  "/server-certs/private-key.pem",
 		CACertPaths: []string{
-			"/server-certs/ca-certificate",
+			"/server-certs/ca-certificate.pem",
 		},
 	}
 	defaultClientTLSConfig = connection.TLSConfig{
 		Mode:     connection.MutualTLSMode,
-		CertPath: "/client-certs/public-key",
-		KeyPath:  "/client-certs/private-key",
+		CertPath: "/client-certs/public-key.pem",
+		KeyPath:  "/client-certs/private-key.pem",
 		CACertPaths: []string{
-			"/client-certs/ca-certificate",
+			"/client-certs/ca-certificate.pem",
 		},
 	}
 )
@@ -443,10 +443,14 @@ func defaultDBConfig() *vc.DatabaseConfig {
 
 func defaultSampleDBConfig() *vc.DatabaseConfig {
 	return &vc.DatabaseConfig{
-		Endpoints:      []*connection.Endpoint{newEndpoint("db", 5433)},
-		Username:       "yugabyte",
-		Password:       "yugabyte",
-		Database:       "yugabyte",
+		Endpoints: []*connection.Endpoint{newEndpoint("db", 5433)},
+		Username:  "yugabyte",
+		Password:  "yugabyte",
+		Database:  "yugabyte",
+		TLS: connection.DatabaseTLSConfig{
+			Mode:       connection.OneSideTLSMode,
+			CACertPath: "/server-certs/ca-certificate.pem",
+		},
 		MaxConnections: 10,
 		MinConnections: 5,
 		LoadBalance:    false,

cmd/config/cobra_test_exports.go

@@ -64,8 +64,8 @@ func StartDefaultSystem(t *testing.T) SystemConfig {
 		},
 		DB: DatabaseConfig{
 			Name:        conn.Database,
-			LoadBalance: false,
 			Endpoints:   conn.Endpoints,
+			LoadBalance: false,
 		},
 		Policy: &workload.PolicyProfile{
 			ChannelID: "channel1",

cmd/config/create_config_file.go

@@ -72,8 +72,10 @@ type (
 	// DatabaseConfig represents the used DB.
 	DatabaseConfig struct {
 		Name        string
+		Password    string
 		LoadBalance bool
 		Endpoints   []*connection.Endpoint
+		TLS         connection.DatabaseTLSConfig
 	}
 )
 

cmd/config/samples/coordinator.yaml

@@ -6,10 +6,10 @@ server:
   endpoint: :9001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
+      - /server-certs/ca-certificate.pem
 monitoring:
   server:
     endpoint: :2119
@@ -19,10 +19,10 @@ verifier:
     - verifier:5001
   tls: &ClientTLS
     mode: mtls
-    cert-path: /client-certs/public-key
-    key-path: /client-certs/private-key
+    cert-path: /client-certs/public-key.pem
+    key-path: /client-certs/private-key.pem
     ca-cert-paths:
-      - /client-certs/ca-certificate
+      - /client-certs/ca-certificate.pem
 validator-committer:
   endpoints:
     - vc:6001

cmd/config/samples/loadgen.yaml

@@ -6,10 +6,10 @@ server:
   endpoint: :8001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
+      - /server-certs/ca-certificate.pem
 monitoring:
   server:
     endpoint: :2118
@@ -26,10 +26,10 @@ orderer-client:
     endpoint: sidecar:4001
     tls:
       mode: mtls
-      cert-path: /client-certs/public-key
-      key-path: /client-certs/private-key
+      cert-path: /client-certs/public-key.pem
+      key-path: /client-certs/private-key.pem
       ca-cert-paths:
-        - /client-certs/ca-certificate
+        - /client-certs/ca-certificate.pem
   orderer:
     connection:
       endpoints:

cmd/config/samples/query.yaml

@@ -8,11 +8,10 @@ server:
   endpoint: :7001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
-  # Credentials for the server
+      - /server-certs/ca-certificate.pem
 monitoring:
   server:
     endpoint: :2117
@@ -24,6 +23,9 @@ database:
   # TODO: pass password via environment variable
   password: "yugabyte" # The password for the database
   database: "yugabyte" # The database name
+  tls:
+    mode: tls
+    ca-cert-path: /server-certs/ca-certificate.pem
   max-connections: 10 # The maximum size of the connection pool
   min-connections: 5 # The minimum size of the connection pool
   load-balance: false # Should be enabled for DB cluster

cmd/config/samples/sidecar.yaml

@@ -6,10 +6,10 @@ server:
   endpoint: :4001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
+      - /server-certs/ca-certificate.pem
   keep-alive:
     params:
       time: 300s
@@ -40,10 +40,10 @@ committer:
   endpoint: coordinator:9001
   tls:
     mode: mtls
-    cert-path: /client-certs/public-key
-    key-path: /client-certs/private-key
+    cert-path: /client-certs/public-key.pem
+    key-path: /client-certs/private-key.pem
     ca-cert-paths:
-      - /client-certs/ca-certificate
+      - /client-certs/ca-certificate.pem
 ledger:
   path: /root/sc/ledger
 notification:

cmd/config/samples/vc.yaml

@@ -8,11 +8,10 @@ server:
   endpoint: :6001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
-  # Credentials for the server
+      - /server-certs/ca-certificate.pem
 monitoring:
   server:
     endpoint: :2116
@@ -23,6 +22,9 @@ database:
   # TODO: pass password via environment variable
   password: "yugabyte" # The password for the database
   database: "yugabyte" # The database name
+  tls:
+    mode: tls
+    ca-cert-path: /server-certs/ca-certificate.pem
   max-connections: 10 # The maximum size of the connection pool
   min-connections: 5 # The minimum size of the connection pool.
   load-balance: false # Should be enabled for DB cluster.

cmd/config/samples/verifier.yaml

@@ -6,10 +6,10 @@ server:
   endpoint: :5001
   tls:
     mode: mtls
-    cert-path: /server-certs/public-key
-    key-path: /server-certs/private-key
+    cert-path: /server-certs/public-key.pem
+    key-path: /server-certs/private-key.pem
     ca-cert-paths:
-      - /server-certs/ca-certificate
+      - /server-certs/ca-certificate.pem
 monitoring:
   server:
     endpoint: :2115

cmd/config/templates/query.yaml

@@ -24,9 +24,12 @@ database:
     {{- end }}
   username: "yugabyte"
   # TODO: pass password via environment variable
-  password: "yugabyte"
+  password: {{ .DB.Password }}
   database: {{ .DB.Name }}
   load-balance: {{ .DB.LoadBalance }}
+  tls:
+    mode: {{ .DB.TLS.Mode }}
+    ca-cert-path: {{ .DB.TLS.CACertPath }}
   max-connections: 10
   min-connections: 5
   retry:

cmd/config/templates/vc.yaml

@@ -23,9 +23,12 @@ database:
     {{- end }}
   username: "yugabyte"
   # TODO: pass password via environment variable
-  password: "yugabyte"
+  password: {{ .DB.Password }}
   database: {{ .DB.Name }}
   load-balance: {{ .DB.LoadBalance }}
+  tls:
+    mode: {{ .DB.TLS.Mode }}
+    ca-cert-path: {{ .DB.TLS.CACertPath }}
   max-connections: 10
   min-connections: 5
   retry:

docker/images/test_node/Dockerfile

@@ -35,6 +35,10 @@ ENV SC_SIDECAR_COMMITTER_TLS_MODE="none"
 ENV SC_VC_SERVER_TLS_MODE="none"
 ENV SC_VERIFIER_SERVER_TLS_MODE="none"
 
+# Disable TLS usage for db.
+ENV SC_VC_DATABASE_TLS_MODE="none"
+ENV SC_QUERY_DATABASE_TLS_MODE="none"
+
 COPY ${ARCHBIN_PATH}/${TARGETOS}-${TARGETARCH}/* ${BINS_PATH}/
 COPY ./docker/images/test_node/run ${BINS_PATH}/
 COPY ./cmd/config/samples $CONFIGS_PATH

docker/test/common.go

@@ -134,7 +134,7 @@ func getContainerMappedHostPort(
 	info, err := createDockerClient(t).ContainerInspect(ctx, containerName)
 	require.NoError(t, err)
 	require.NotNil(t, info)
-	portKey := nat.Port(fmt.Sprintf("%s/%s", containerPort, "tcp"))
+	portKey := nat.Port(fmt.Sprintf("%s/tcp", containerPort))
 	bindings, ok := info.NetworkSettings.Ports[portKey]
 	require.True(t, ok)
 	require.NotEmpty(t, bindings)