server: propagate TLS flags to tiflow options (#4083)#4183
Conversation
ti-chi-bot
bot
added
the
release-note
ti-chi-bot
added
lgtm
size/L
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Summary of ChangesHello @ti-chi-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves a critical bug in TiCDC's old architecture mode where TLS configuration flags were not correctly passed to the underlying TiFlow server. The fix ensures that when TiCDC connects to HTTPS-enabled PD endpoints and TLS credentials are provided via CLI flags, these security settings are properly recognized and applied by the TiFlow server, preventing startup failures related to secure communication. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly addresses an issue where TLS flags were not being propagated to tiflow options in the old architecture mode, which could cause failures with HTTPS PD endpoints. The logic has been cleanly refactored into a new buildTiFlowServerOptions function, which improves code organization and testability. The new unit test is comprehensive and validates the fix effectively. I have one suggestion to enhance error handling consistency.
| cfgData, err := json.Marshal(o.serverConfig) | ||
| if err != nil { | ||
| return errors.Trace(err) | ||
| return nil, errors.Trace(err) | ||
| } | ||
|
|
||
| var oldCfg tiflowConfig.ServerConfig | ||
| err = json.Unmarshal(cfgData, &oldCfg) | ||
| if err != nil { | ||
| return errors.Trace(err) | ||
| return nil, errors.Trace(err) | ||
| } |
There was a problem hiding this comment.
For improved error handling and consistency with other parts of the codebase (like pkg/config/server.go), it would be better to use the specific ErrEncodeFailed and ErrDecodeFailed errors from the pkg/errors package. This will provide more context when debugging JSON marshaling or unmarshaling failures.
| cfgData, err := json.Marshal(o.serverConfig) | |
| if err != nil { | |
| return errors.Trace(err) | |
| return nil, errors.Trace(err) | |
| } | |
| var oldCfg tiflowConfig.ServerConfig | |
| err = json.Unmarshal(cfgData, &oldCfg) | |
| if err != nil { | |
| return errors.Trace(err) | |
| return nil, errors.Trace(err) | |
| } | |
| cfgData, err := json.Marshal(o.serverConfig) | |
| if err != nil { | |
| return nil, errors.ErrEncodeFailed.Wrap(err) | |
| } | |
| var oldCfg tiflowConfig.ServerConfig | |
| err = json.Unmarshal(cfgData, &oldCfg) | |
| if err != nil { | |
| return nil, errors.ErrDecodeFailed.GenWithStackByArgs(err) | |
| } |
hongyunyan
merged commit 08a176f
into
pingcap:release-8.5-20260129-v8.5.5
3 participants
This is an automated cherry-pick of #4083
What problem does this PR solve?
Issue Number: close #4082
What is changed and how it works?
In old architecture mode, TiCDC delegates to
github.com/pingcap/tiflow/pkg/cmd/serverbut reuses TiCDC's cobra command, so cobra flags are bound to TiCDC's options instead of tiflow's.tiflow
Options.complete()rebuildsServerConfig.SecurityfromtiflowServer.Options.CaPath/CertPath/KeyPath, so TiCDC must propagate TLS flag values into those fields. Otherwise, when TLS flags are present on the CLI, tiflow sees them as visited but with empty values, overwrites the security config to empty, and fails https PD endpoint validation.This PR adds a small adapter function to build tiflow server options and explicitly fills
CaPath/CertPath/KeyPath/AllowedCertCN.Check List
Tests
go test ./cmd/cdc/server -run TestBuildTiFlowServerOptionsPropagatesTLSFlags)Questions
Will it cause performance regression or break compatibility?
No. This only affects old architecture mode's delegation path and only changes how TLS flags are propagated to tiflow options.
Do you need to update user documentation, design documentation or monitoring documentation?
N/A
Release note
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.