Skip to content

[database] Add TLS support for database connections#159

Merged
dean-amar merged 26 commits into
hyperledger:mainfrom
dean-amar:database-tls
Nov 11, 2025
Merged

[database] Add TLS support for database connections#159
dean-amar merged 26 commits into
hyperledger:mainfrom
dean-amar:database-tls

Conversation

@dean-amar

@dean-amar dean-amar commented Oct 22, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Type of change

  • New feature
  • Improvement (improvement to code, performance, etc)
  • Test update

Description

  • Add support for DB connection with TLS.
  • Add a secured database node creation (PostgreSQL or YugabyteDB).
  • Add file extensions to the TLS certificates.

Related issues

@dean-amar
Added suppoer for YugabyteDB or PostgreSQL secure db node for the rel…
6ba2360 
…ease-image-integration-test.

Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* fixed template issues.
2066839 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Semantic and code-hygiene changes.
30392ae 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* rebased with main.
91cda7f 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar dean-amar added enhancement New feature or request security labels Oct 22, 2025
@dean-amar
* updated according to main.
0a5f202 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* minor semantic change.
b0d5ad6 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* changed tls field to 'mode' - match the services tls configs.
3f8c875 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* improved code readability.
61b0fc5 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* code rebase.
dcbe443 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar dean-amar marked this pull request as ready for review October 30, 2025 17:31
liran-funaro
liran-funaro reviewed Nov 3, 2025
View reviewed changes
Comment thread docker/test/container_release_image_test.go Outdated
Comment thread cmd/config/samples/query.yaml Outdated
Comment thread docker/test/container_release_image_test.go Outdated
Comment thread docker/test/container_release_image_test.go Outdated
Comment thread docker/test/container_release_image_test.go Outdated
Comment thread service/vc/dbtest/connection.go Outdated
Comment thread service/vc/config.go
Comment thread utils/test/secure_connection.go Outdated
Comment thread utils/test/secure_connection.go Outdated
Comment thread utils/test/secure_connection.go Outdated
@dean-amar
* Addressed PR comments.
dd329ec 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Minor issues fixed.
6171523 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Revert to serial scripts execution.
b35994d 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* preset permissions to certificates
8ee290b 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* revert latest changes.
21af124 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Addressed PR comments.
8818efd 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Rebased with main.
25ca8b1 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Code hygiene.
e391bc3 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
liran-funaro
liran-funaro reviewed Nov 10, 2025
View reviewed changes
Comment thread docker/test/container_release_image_test.go Outdated
Comment thread utils/test/utils.go Outdated
Comment thread utils/connection/client_util.go Outdated
Comment thread utils/connection/config.go Outdated
Comment thread service/vc/dbtest/container.go
Comment thread service/vc/dbtest/container.go Outdated
// is ready to accept connections.
// It repeatedly executes `pg_isready` until the command
// returns a successful exit code (0) or the timeout is reached.
func (dc *DatabaseContainer) EnsurePostgresNodeReadiness(t *testing.T, port string) {

@liran-funaro liran-funaro Nov 10, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YugabyteDB should support pg_isready

@dean-amar dean-amar Nov 10, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is, but not naturally. We need to export the path to its postgres tools. It's easier to monitor its readiness by its logs.

Comment thread service/vc/dbtest/container.go Outdated
Comment thread service/vc/dbtest/container.go Outdated
func (dc *DatabaseContainer) ReadPasswordFromContainer(t *testing.T, filePath string) string {
t.Helper()
output, exitCode := dc.ExecuteCommand(t, []string{"cat", filePath})
require.Zero(t, exitCode)

@liran-funaro liran-funaro Nov 10, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

major: If the file doesn't exist, it fails the test.
But if it exists, and doesn't contain the password, it won't fail the tests.
This inconsistency is not justified.
Please fix or add a comment to justify this.

@dean-amar dean-amar Nov 10, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We use this method only when a secured YugabyteDB node is started. If the file doesn’t exist, the test should fail. If the file exists but doesn’t contain a password, we fall back to the default password.

I'll add the above to the function's comment.

@liran-funaro liran-funaro Nov 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if we try the default password for the secured test, it will not work, right? So, isn't it best to fail the test?

@dean-amar dean-amar Nov 11, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I’m not sure how the database behaves in that case, but for consistency, we’ll fail the test in this scenario as well.

Comment thread service/vc/dbtest/container.go
Comment thread service/vc/dbtest/container.go Outdated
liran-funaro
liran-funaro reviewed Nov 10, 2025
View reviewed changes
Comment thread docker/test/container_release_image_test.go Outdated
@dean-amar
* Addressed PR comments.
64d8575 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Addressed PR comments.
a43e199 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Updated according to upstream.
5de4bd8 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* minor documentation update.
389f4ee 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* Addressed PR's comments.
0f6e259 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* rebased to main.
4e0ae75 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* minor changes and mock-orderer yaml correction.
de0d451 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* rebased to main.
7ec9414 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar
* linter issue fixed.
5a8c41f 
Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
@dean-amar dean-amar merged commit 2f40bb4 into hyperledger:main Nov 11, 2025
12 checks passed
@dean-amar dean-amar deleted the database-tls branch February 18, 2026 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@liran-funaro liran-funaro Awaiting requested review from liran-funaro

Assignees

No one assigned

Labels

enhancement New feature or request security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Enable TLS Authentication for PostgreSQL Enable TLS Authentication for YugabyteDB

2 participants

@dean-amar @liran-funaro