TLS for mysql

README.md

@@ -38,7 +38,8 @@ I recommend checking out [Chronos](https://github.com/airbnb/chronos). This is d
 Once you have installed Kala onto the machine you would like to use, you can follow the below steps to start using it.
 
 To Run Kala:
-```bash
+
+```console
 $ kala run
 INFO[0000] Preparing cache
 INFO[0000] Starting server on port :8000
@@ -48,30 +49,44 @@ INFO[0000] Preparing cache
 INFO[0000] Starting server on port :2222
 ```
 
-Kala uses BoltDB by default for the job database
-use Redis by using the jobDB and jobDBAddress params:
+Kala uses BoltDB by default for the job database by using `jobDB` and `boltpath` params:
+
+```bash
+kala run --jobDB=boltdb --boltpath=/path/to/dir
+```
+
+use Redis by using the `jobDB` and `jobDBAddress` params:
 
 ```bash
 kala run --jobDB=redis --jobDBAddress=127.0.0.1:6379
 ```
-use Consul by using the jobDB and jobDBAddress params:
+
+use Consul by using the `jobDB` and `jobDBAddress` params:
 
 ```bash
 kala run --jobDB=consul --jobDBAddress=127.0.0.1:8500
 ```
 
-use Mongo by using the jobDB, jobDBAddress, jobDBUsername, and jobDBPassword params:
+use Mongo by using the `jobDB`, `jobDBAddress`, `jobDBUsername`, and `jobDBPassword` params:
 
 ```bash
 kala run --jobDB=mongo --jobDBAddress=server1.example.com,server2.example.com --jobDBUsername=admin --jobDBPassword=password
 ```
 
-use Postgres by using the jobDB, jobDBAddress params:
+use Postgres by using the `jobDB`, `jobDBAddress` params:
 
 ```bash
 kala run --jobDB=postgres --jobDBAddress=server1.example.com/kala --jobDBUsername=admin --jobDBPassword=password
 ```
 
+use MariaDB, MySQL by using the `jobDB`, `jobDBAddress`, `jobDBTlsCAPath`, `jobDBTlsCertPath`, `jobDBTlsKeyPath`, `jobDBTlsServerName` params:
+
+```bash
+kala run --jobDB=mariadb --jobDBAddress=(server1.example.com)/kala --jobDBUsername=admin --jobDBPassword=password
+
+kala run --jobDB=mysql --jobDBAddress="tcp(server1.example.com:3306)/kala?tls=custom" --jobDBUsername=admin --jobDBPassword=password --jobDBTlsCAPath=/path/to/server-ca.pem --jobDBTlsCertPath=/path/to/client-cert.pem --jobDBTlsKeyPath=/path/to/client-key.pem --jobDBTlsServerName=server1.example.com
+```
+
 Kala runs on `127.0.0.1:8000` by default. You can easily test it out by curling the metrics path.
 
 ```bash

cmd/app.go

@@ -4,6 +4,9 @@ import (
 	"fmt"
 	"strings"
 	"time"
+	"crypto/tls"
+	"crypto/x509"
+	"io/ioutil"
 
 	"github.com/ajvb/kala/api"
 	"github.com/ajvb/kala/job"
@@ -80,7 +83,7 @@ func init() {
 				cli.StringFlag{
 					Name:  "jobDB",
 					Value: "boltdb",
-					Usage: "Implementation of job database, either 'boltdb', 'redis', 'mongo', 'consul', or 'postgres'.",
+					Usage: "Implementation of job database, either 'boltdb', 'redis', 'mongo', 'consul', 'postgres', 'mariadb', or 'mysql'.",
 				},
 				cli.StringFlag{
 					Name:  "boltpath",
@@ -95,13 +98,33 @@ func init() {
 				cli.StringFlag{
 					Name:  "jobDBUsername",
 					Value: "",
-					Usage: "Username for the job database, in 'username' format. Currently only needed for Mongo.",
+					Usage: "Username for the job database, in 'username' format.",
 				},
 				cli.StringFlag{
 					Name:  "jobDBPassword",
 					Value: "",
 					Usage: "Password for the job database, in 'password' format.",
 				},
+				cli.StringFlag{
+					Name:  "jobDBTlsCAPath",
+					Value: "",
+					Usage: "Path to tls server CA file for the job database.",
+				},
+				cli.StringFlag{
+					Name:  "jobDBTlsCertPath",
+					Value: "",
+					Usage: "Path to tls client cert file for the job database.",
+				},
+				cli.StringFlag{
+					Name:  "jobDBTlsKeyPath",
+					Value: "",
+					Usage: "Path to tls client key file for the job database.",
+				},
+				cli.StringFlag{
+					Name:  "jobDBTlsServerName",
+					Value: "",
+					Usage: "Server name to verify cert for the job database.",
+				},
 				cli.BoolFlag{
 					Name:  "verbose, v",
 					Usage: "Set for verbose logging.",
@@ -165,9 +188,32 @@ func init() {
 				case "postgres":
 					dsn := fmt.Sprintf("postgres://%s:%s@%s", c.String("jobDBUsername"), c.String("jobDBPassword"), c.String("jobDBAddress"))
 					db = postgres.New(dsn)
-				case "mysql":
+				case "mysql", "mariadb":
 					dsn := fmt.Sprintf("%s:%s@%s", c.String("jobDBUsername"), c.String("jobDBPassword"), c.String("jobDBAddress"))
-					db = mysql.New(dsn)
+					if c.String("jobDBTlsCAPath") != "" {
+						// https://godoc.org/github.com/go-sql-driver/mysql#RegisterTLSConfig
+						rootCertPool := x509.NewCertPool()
+						pem, err := ioutil.ReadFile(c.String("jobDBTlsCAPath"))
+						if err != nil {
+								log.Fatal(err)
+						}
+						if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
+								log.Fatal("Failed to append PEM.")
+						}
+						clientCert := make([]tls.Certificate, 0, 1)
+						certs, err := tls.LoadX509KeyPair(c.String("jobDBTlsCertPath"), c.String("jobDBTlsKeyPath"))
+						if err != nil {
+								log.Fatal(err)
+						}
+						clientCert = append(clientCert, certs)
+						db = mysql.New(dsn, &tls.Config{
+							RootCAs: rootCertPool,
+							Certificates: clientCert,
+							ServerName: c.String("jobDBTlsServerName"),
+						})
+					} else {
+						db = mysql.New(dsn, nil)
+					}
 				default:
 					log.Fatalf("Unknown Job DB implementation '%s'", c.String("jobDB"))
 				}

job/storage/mysql/mysql.go

@@ -4,8 +4,9 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"crypto/tls"
 
-	_ "github.com/go-sql-driver/mysql"
+	"github.com/go-sql-driver/mysql"
 
 	"github.com/jmoiron/sqlx"
 
@@ -23,7 +24,14 @@ type DB struct {
 }
 
 // New instantiates a new DB.
-func New(dsn string) *DB {
+func New(dsn string, tlsConfig *tls.Config) *DB {
+	if tlsConfig != nil {
+		log.Infof("Register TLS config")
+		err := mysql.RegisterTLSConfig("custom", tlsConfig)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
 	connection, err := sqlx.Open("mysql", dsn)
 	if err != nil {
 		log.Fatal(err)

job/storage/mysql/mysql_test.go

@@ -136,7 +136,7 @@ func TestRealDb(t *testing.T) {
 		}
 	}
 
-	db := New(dsn)
+	db := New(dsn, nil)
 	cache := job.NewLockFreeJobCache(db)
 
 	genericMockJobOne := job.GetMockJobWithGenericSchedule(time.Now())
@@ -229,7 +229,7 @@ func TestPersistEpsilon(t *testing.T) {
 		}
 	}
 
-	db := New(dsn)
+	db := New(dsn, nil)
 	defer db.Close()
 
 	cache := job.NewMemoryJobCache(db)