feat(clickhouse): add directory-based TLS certificate loading#3938
Conversation
jkaflik
changed the base branch from
kk/clickhouse-peer-tls-k8s-secret
to
main
|
|
❌ 2 Tests Failed:
View the top 2 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
whites11
force-pushed
the
kk/clickhouse-peer-tls-directory-approach
branch
from
a7796e9 to
f50a871
Compare
❌ Test FailureAnalysis: Real build failure: generated proto types (FlowOperation, PostgresConfig, DynamicSetting, etc.) are undefined after the "Stubbed generated modules" commit, causing compilation to fail before any tests run. |
❌ Test FailureAnalysis: Deterministic build failure caused by undefined protobuf types (protos.FlowOperation, protos.PostgresConfig, etc.) after generated modules were stubbed out in the latest dependency update commit. |
❌ Test FailureAnalysis: Real build failure: generated proto stubs from commit #4250 left |
❌ Test FailureAnalysis: Deterministic build failure: proto-generated symbols ( |
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
whites11
force-pushed
the
kk/clickhouse-peer-tls-directory-approach
branch
from
4a3052e to
c92cd39
Compare
…er support Add TLS certificate directory support for ClickHouse peers, enabling certificates to be loaded from a mounted Kubernetes Secret (cert-manager). Client certs are re-read on every TLS handshake via GetClientCertificate, so rotated certificates are picked up without requiring a restart. Also fixes generate-protos.sh to use POSIX-compatible shell syntax (the &> bashism silently broke proto generation on cache miss). Co-Authored-By: Kuba Kaflik <kuba.kaflik@clickhouse.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
whites11
force-pushed
the
kk/clickhouse-peer-tls-directory-approach
branch
from
c92cd39 to
29f3711
Compare
❌ Test FailureAnalysis: Build failure caused by |
🔄 Flaky Test DetectedAnalysis: All three failures across different matrix configurations share the same transient ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: The test failed because the PostgreSQL catalog connection was killed by an administrator command (SQLSTATE 57P01 / admin_shutdown), which is an infrastructure timing issue caused by another test's teardown, not a code defect. ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: The test ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: The test failed due to SQLSTATE 57P01 ("terminating connection due to administrator command"), a transient PostgreSQL catalog connection drop caused by CI infrastructure, not a code defect. ✅ Automatically retrying the workflow |
whites11
changed the title
🔄 Flaky Test DetectedAnalysis: Test failed with PostgreSQL SQLSTATE 57P01 (admin_shutdown) — the catalog connection was forcibly terminated by another parallel test, almost certainly a ToxiProxy-based test disrupting the shared postgres catalog used by TestApiMongo/TestTableAdditionWithoutInitialLoad. ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: Three MySQL→ClickHouse e2e tests timed out waiting for CDC/initial load data via WaitFor polling loops, with the entire suite running 863s out of a 900s limit — a classic timing/resource-contention flake, not a logic regression. ✅ Automatically retrying the workflow |
…ry TLS Distinguish "file not found" (ca.crt is optional) from other read errors (e.g. permission denied) that would otherwise be silently swallowed, leading to confusing TLS failures downstream.
🔄 Flaky Test DetectedAnalysis: TestPeerFlowE2ETestSuitePG_CH/Test_Binary_Format_Raw failed during teardown due to a race condition where the replication slot was still held by an active PID when cleanup tried to drop it (SQLSTATE 55006), a timing-dependent failure in a high-parallelism (-p 32) e2e test environment. ✅ Automatically retrying the workflow |
4 participants
Add
tls_certificate_directoryoption to ClickHouse peers for loading TLS certificates from a directory (e.g. a Kubernetes Secret mounted by cert-manager).GetClientCertificate, picking up rotations without restartgenerate-protos.sh(&>bashism broke proto generation on cache miss)