[HOPSWORKS-1140] Online featurestore (logicalclocks#33)

.gitignore

@@ -5,3 +5,4 @@ Berksfile.lock
 cookbooks/*
 cookbooks
 nohup.out
+.idea

Karamelfile

@@ -6,6 +6,9 @@ dependencies:
     global:  
       - ndb::mgmd
       - ndb::ndbd
+  - recipe: ndb::mysqld_tls
+    global:  
+      - kagent::default
   - recipe: ndb::memcached
     global:  
       - ndb::mysqld

attributes/default.rb

@@ -178,6 +178,9 @@
 # MySQL Server Master-Slave replication binary log is enabled.
 default['mysql']['replication_enabled']               = "false"
 
+# MySQL Server TLS/SSL enabled
+default['mysql']['tls']                               = "false"
+
 # This is the username/password for any mysql server (mysqld) started.
 # It is required by mysql clients to use the mysql server.
 default['mysql']['user']                              = "kthfs"

metadata.rb

@@ -16,6 +16,7 @@
 recipe            "ndb::mgmd", "Installs a MySQL Cluster management server (ndb_mgmd)"
 recipe            "ndb::ndbd", "Installs a MySQL Cluster data node (ndbd)"
 recipe            "ndb::mysqld", "Installs a MySQL Server connected to the MySQL Cluster (mysqld)"
+recipe            "ndb::mysqld_tls", "Configure TLS for MySQL servers using host certificates"
 
 recipe            "ndb::purge", "Removes all data and all binaries related to a MySQL Cluster installation"
 
@@ -118,6 +119,10 @@
           :description => "Enable replication for the mysql server",
           :type => 'string'
 
+attribute "mysql/tls",
+          :description => "Enable TLS/SSL for the mysql server",
+          :type => 'string'
+
 attribute "ndb/wait_startup",
           :description => "Max amount of time a MySQL server should wait for the ndb nodes to be up",
           :type => 'string'
@@ -429,4 +434,4 @@
 
 attribute "ndb/num_ndb_open_slots",
           :description => "Number of slots open for new clients to connect.",
-          :type => "string"
+          :type => "string"

recipes/mysqld.rb

@@ -69,7 +69,10 @@
   action :create
   variables({
    :mysql_id => found_id,
-   :my_ip => mysql_ip
+   :my_ip => mysql_ip,
+   # Here is always false, as this recipe is run before certificates are available
+   # if mysql/tls is enabled, the file will be re-templated later
+   :mysql_tls => false
   })
   if node['services']['enabled'] == "true"
     notifies :enable, resources(:service => service_name), :immediately

templates/default/grants.sql.erb

@@ -4,5 +4,9 @@ GRANT ALL PRIVILEGES ON *.* to '<%= node['mysql']['user'] %>'@'localhost' identi
 GRANT ALL PRIVILEGES ON *.* to '<%= node['mysql']['user'] %>'@'127.0.0.1' identified by '<%= node['mysql']['password'] %>';
 GRANT ALL PRIVILEGES ON *.* to '<%= node['mysql']['user'] %>'@'<%= @my_ip %>' identified by '<%= node['mysql']['password'] %>';
 GRANT ALL PRIVILEGES ON *.* to '<%= node['mysql']['user'] %>'@'%' identified by '<%= node['mysql']['password'] %>';
+GRANT GRANT OPTION ON *.* to '<%= node['mysql']['user'] %>'@'localhost' identified by '<%= node['mysql']['password'] %>';
+GRANT GRANT OPTION ON *.* to '<%= node['mysql']['user'] %>'@'127.0.0.1' identified by '<%= node['mysql']['password'] %>';
+GRANT GRANT OPTION ON *.* to '<%= node['mysql']['user'] %>'@'<%= @my_ip %>' identified by '<%= node['mysql']['password'] %>';
+GRANT GRANT OPTION ON *.* to '<%= node['mysql']['user'] %>'@'%' identified by '<%= node['mysql']['password'] %>';
 
 

templates/default/my-ndb.cnf.erb

@@ -61,10 +61,19 @@ ndb-batch-size=24M
 
 # replication settings go here
 <% if node['mysql']['replication_enabled'] == "true" -%>
-server-id=@server_id
+server-id=<%= @mysql_id %>
 log-bin=mysql-bin
 <% end -%>
 
+#################################################
+# TLS/SSL Settings
+#################################################
+
+<% if @mysql_tls -%>
+# ssl-ca=<%= node['kagent']['certs_dir'] %>/hops_root_ca.pem
+ssl-cert=<%= node['kagent']['certs_dir'] %>/pub.pem
+ssl-key=<%= node['kagent']['certs_dir'] %>/priv.key.rsa
+<% end -%>
 
 #################################################
 # mysql_cluster connection params