@@ -107,6 +107,22 @@ const (
107107 DefAuthTokenRefreshInterval = time .Hour
108108 // EnvVarKeyspaceName is the system env name for keyspace name.
109109 EnvVarKeyspaceName = "KEYSPACE_NAME"
110+ // EnvClusterCA is the system env name for cluster CA path.
111+ EnvClusterCA = "CLUSTER_CA"
112+ // EnvClusterCert is the system env name for cluster cert path.
113+ EnvClusterCert = "CLUSTER_CERT"
114+ // EnvClusterKey is the system env name for cluster key path.
115+ EnvClusterKey = "CLUSTER_KEY"
116+ // EnvSQLCA is the system env name for SQL CA path.
117+ EnvSQLCA = "SQL_CA"
118+ // EnvSQLCert is the system env name for SQL cert path.
119+ EnvSQLCert = "SQL_CERT"
120+ // EnvSQLKey is the system env name for SQL key path.
121+ EnvSQLKey = "SQL_KEY"
122+ // EnvPodIP is the system env name for pod IP.
123+ EnvPodIP = "POD_IP"
124+ // EnvNamespace is the system env name for namespace.
125+ EnvNamespace = "NAMESPACE"
110126 // MaxTokenLimit is the max token limit value.
111127 MaxTokenLimit = 1024 * 1024
112128 DefSchemaLease = 45 * time .Second
@@ -203,6 +219,8 @@ type Config struct {
203219 DeployMode deploymode.Mode `toml:"deploy-mode" json:"deploy-mode"`
204220 KeyspaceName string `toml:"keyspace-name" json:"keyspace-name"`
205221 TiKVWorkerURL string `toml:"tikv-worker-url" json:"tikv-worker-url"`
222+ TiKVAPIServiceAddr string `toml:"tikv-api-service-addr" json:"tikv-api-service-addr"`
223+ TiDBWorker tidbWorkerConfig `toml:"tidb-worker" json:"tidb-worker"`
206224 Log Log `toml:"log" json:"log"`
207225 Instance Instance `toml:"instance" json:"instance"`
208226 Security Security `toml:"security" json:"security"`
@@ -333,6 +351,10 @@ type Config struct {
333351 MeteringStorageURI string `toml:"metering-storage-uri" json:"metering-storage-uri"`
334352}
335353
354+ type tidbWorkerConfig struct {
355+ APIServerAddr string `toml:"api-server-addr" json:"api-server-addr"`
356+ }
357+
336358// RUV2Config is the configuration for RU v2 weight calculation.
337359// The default values are experimentally fitted so they stay stable under the
338360// same workload while remaining numerically aligned with RU v1.
@@ -1344,13 +1366,90 @@ func InitializeConfig(confPath string, configCheck, configStrict bool, enforceCm
13441366 fmt .Fprintln (os .Stderr , "invalid config" , err )
13451367 os .Exit (1 )
13461368 }
1369+ if err := cfg .AdjustStarterConfig (cfg .DeployMode == deploymode .Starter ); err != nil {
1370+ fmt .Fprintln (os .Stderr , "invalid security env vars" , err )
1371+ os .Exit (1 )
1372+ }
13471373 if configCheck {
13481374 fmt .Println ("config check successful" )
13491375 os .Exit (0 )
13501376 }
13511377 StoreGlobalConfig (cfg )
13521378}
13531379
1380+ // AdjustStarterConfig applies starter-only security and service-address overrides.
1381+ func (c * Config ) AdjustStarterConfig (isStarter bool ) error {
1382+ if ! isStarter {
1383+ return nil
1384+ }
1385+ if err := c .adjustSecurityConfig (); err != nil {
1386+ return err
1387+ }
1388+ c .adjustServiceAddr ()
1389+ return nil
1390+ }
1391+
1392+ func trimScheme (addr string ) string {
1393+ addr = strings .TrimPrefix (addr , "http://" )
1394+ addr = strings .TrimPrefix (addr , "https://" )
1395+ return addr
1396+ }
1397+
1398+ func (c * Config ) adjustServiceAddr () {
1399+ scheme := "http://"
1400+ if len (c .Security .ClusterSSLCA ) > 0 {
1401+ scheme = "https://"
1402+ }
1403+ if len (c .TiKVAPIServiceAddr ) > 0 {
1404+ c .TiKVAPIServiceAddr = scheme + trimScheme (c .TiKVAPIServiceAddr )
1405+ }
1406+ if len (c .TiDBWorker .APIServerAddr ) > 0 {
1407+ c .TiDBWorker .APIServerAddr = scheme + trimScheme (c .TiDBWorker .APIServerAddr )
1408+ }
1409+ }
1410+
1411+ func (c * Config ) adjustSecurityConfig () error {
1412+ clusterCAPath := os .Getenv (EnvClusterCA )
1413+ clusterCertPath := os .Getenv (EnvClusterCert )
1414+ clusterKeyPath := os .Getenv (EnvClusterKey )
1415+ if len (clusterCAPath ) > 0 && (len (clusterCertPath ) == 0 || len (clusterKeyPath ) == 0 ) {
1416+ return errors .New ("both CLUSTER_CERT and CLUSTER_KEY must be set when CLUSTER_CA is set" )
1417+ }
1418+ if len (clusterCAPath ) > 0 {
1419+ c .Security .ClusterSSLCA = clusterCAPath
1420+ c .Security .ClusterSSLCert = clusterCertPath
1421+ c .Security .ClusterSSLKey = clusterKeyPath
1422+ }
1423+
1424+ sqlCAPath := os .Getenv (EnvSQLCA )
1425+ sqlCertPath := os .Getenv (EnvSQLCert )
1426+ sqlKeyPath := os .Getenv (EnvSQLKey )
1427+ if len (sqlCAPath ) > 0 && (len (sqlCertPath ) == 0 || len (sqlKeyPath ) == 0 ) {
1428+ return errors .New ("both SQL_CERT and SQL_KEY must be set when SQL_CA is set" )
1429+ }
1430+ if len (sqlCAPath ) > 0 {
1431+ c .Security .SSLCA = sqlCAPath
1432+ c .Security .SSLCert = sqlCertPath
1433+ c .Security .SSLKey = sqlKeyPath
1434+ }
1435+
1436+ podIP := os .Getenv (EnvPodIP )
1437+ namespace := os .Getenv (EnvNamespace )
1438+ if len (podIP ) > 0 && len (namespace ) > 0 {
1439+ c .AdvertiseAddress = podDNSName (podIP , namespace )
1440+ }
1441+
1442+ return nil
1443+ }
1444+
1445+ func podDNSName (podIP string , namespace string ) string {
1446+ return fmt .Sprintf (
1447+ "%s.%s.pod.cluster.local" ,
1448+ strings .ReplaceAll (podIP , "." , "-" ),
1449+ namespace ,
1450+ )
1451+ }
1452+
13541453// RemovedVariableCheck checks if the config file contains any items
13551454// which have been removed. These will not take effect any more.
13561455func (c * Config ) RemovedVariableCheck (confFile string ) error {
0 commit comments