Skip to content

User-defined Certificate Authority (CA) in asynchronous replication #21458

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 28, 2025
Merged

User-defined Certificate Authority (CA) in asynchronous replication #21458

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6578064
User-defined Certificate Authority (CA) in asynchronous replication
CyberROFL Jul 21, 2025
4a85c17
Fix review issues
CyberROFL Jul 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ydb/docs/en/core/reference/configuration/tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,3 +124,5 @@ tracing_config:
## Asynchronous replication

[Asynchronous replication](../../concepts/async-replication.md) synchronizes data between two {{ ydb-short-name }} databases, where one serves as a client to the other. Whether this communication uses TLS-encrypted connections is controlled by the `CONNECTION_STRING` setting of [CREATE ASYNC REPLICATION](../../yql/reference/syntax/create-async-replication.md) queries. Use the `grpcs://` protocol for TLS connections. No changes to the server-side configuration are required.

When using a custom Certificate Authority (CA), pass its certificate in the `CA_CERT` parameter when creating an instance of asynchronous replication.
13 changes: 13 additions & 0 deletions ydb/docs/en/core/yql/reference/syntax/create-async-replication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ WITH (option = value [, ...])


* `CONNECTION_STRING` — a [connection string](../../../concepts/connect.md#connection_string) for the source database (mandatory).
* `CA_CERT` — a [root certificate for TLS](../../../concepts/connect.md#tls-cert). Optional parameter. Can be specified if the source database supports an encrypted data interchange protocol (`CONNECTION_STRING` starts with `grpcs://`).
* Authentication details for the source database (mandatory) depending on the authentication method:

* [Access token](../../../recipes/ydb-sdk/auth-access-token.md):
Expand Down Expand Up @@ -89,6 +90,18 @@ WITH (
);
```

The following statement creates an asynchronous replication instance with a TLS root certificate specified:

```yql
CREATE ASYNC REPLICATION my_consistent_replication
FOR original_table AS replica_table
WITH (
CONNECTION_STRING = 'grpcs://example.com:2135/?database=/Root/another_database',
TOKEN_SECRET_NAME = 'my_secret',
CA_CERT = '-----BEGIN CERTIFICATE-----...'
);
```

The following statement creates an asynchronous replication instance in global data consistency mode (default change commit interval is 10 seconds):

```yql
Expand Down
2 changes: 2 additions & 0 deletions ydb/docs/ru/core/reference/configuration/tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,4 +129,6 @@ tracing_config:

[Асинхронная репликация](../../concepts/async-replication.md) синхронизирует данные между двумя базами данных {{ ydb-short-name }}, одна из которых выступает в роли клиента для другой. Использование TLS при такой коммуникации контролируется параметром `CONNECTION_STRING` в запросах [CREATE ASYNC REPLICATION](../../yql/reference/syntax/create-async-replication.md). Для TLS-соединений используйте протокол `grpcs://`. Изменения в серверной конфигурации не требуются.

При использовании пользовательского удостоверяющего центра (Certificate Authority, CA) передайте его сертификат в параметре `CA_CERT` при создании экземпляра асинхронной репликации.

{% endif %}
13 changes: 13 additions & 0 deletions ydb/docs/ru/core/yql/reference/syntax/create-async-replication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ WITH (option = value [, ...])
### Параметры {#params}

* `CONNECTION_STRING` — [строка соединения](../../../concepts/connect.md#connection_string) c базой-источником. Обязательный параметр.
* `CA_CERT` — [корневой сертификат для TLS](../../../concepts/connect.md#tls-cert). Необязательный параметр. Может быть указан, если база-источник поддерживает режим обмена данными с шифрованием (`CONNECTION_STRING` начинается с `grpcs://`).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

мне кажется, что здесь не хватает важных слов про то, когда этот параметр нужен. А он нужен, когда свой CA

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Эти слова есть на соседней странице.

* Настройки для аутентификации в базе-источнике одним из способов (обязательно):

* С помощью [токена](../../../recipes/ydb-sdk/auth-access-token.md):
Expand Down Expand Up @@ -90,6 +91,18 @@ WITH (
);
```

Создание экземпляра асинхронной репликации с указанием корневого сертификата для TLS:

```yql
CREATE ASYNC REPLICATION my_consistent_replication
FOR original_table AS replica_table
WITH (
CONNECTION_STRING = 'grpcs://example.com:2135/?database=/Root/another_database',
TOKEN_SECRET_NAME = 'my_secret',
CA_CERT = '-----BEGIN CERTIFICATE-----...'
);
```

Создание экземпляра асинхронной репликации в режиме глобальной согласованности данных (периодичность фиксации изменений по умолчанию — 10 секунд):

```yql
Expand Down