-
-
Notifications
You must be signed in to change notification settings - Fork 62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Connecting to ClickHouse with SSL Port: Unexpected Packet from Server #6458
Labels
Comments
untitaker
added a commit
that referenced
this issue
Jan 14, 2025
### Description This pull request introduces SSL/TLS support for ClickHouse connections in the Snuba project. The changes include new CLI options for enabling secure connections, updates to the ClickhousePool and HTTPBatchWriter classes, and corresponding configuration options in settings and tests. ### Changes Overview 1. **CLI Options**: - Introduced new CLI options for enabling secure connections to ClickHouse: - `--clickhouse-secure`: If true, an encrypted connection will be used. - `--clickhouse-ca-certs`: An optional path to certificates directory. - `--clickhouse-verify`: Verify ClickHouse SSL cert. 2. **Class Updates**: - Modified `ClickhousePool`, `HTTPBatchWriter`, and other relevant classes to support SSL/TLS connections. - Updated constructors and methods to accept and handle SSL/TLS parameters. 3. **Configuration**: - Added SSL/TLS configuration options in settings and tests. - Updated environment variables to support SSL/TLS settings. 4. **Testing**: - Included SSL/TLS configuration in test cases. - Updated existing tests to ensure compatibility with SSL/TLS options. ### Detailed Changes - **snuba/cli/cleanup.py**: Added new CLI options for secure ClickHouse connections. - **snuba/cli/migrations.py**: Added new CLI options for secure ClickHouse connections. - **snuba/cli/optimize.py**: Added new CLI options for secure ClickHouse connections. - **snuba/clickhouse/http.py**: Modified `HTTPBatchWriter` to support SSL/TLS connections. - **snuba/clickhouse/native.py**: Updated `ClickhousePool` to handle SSL/TLS parameters. - **snuba/clusters/cluster.py**: Updated `ClickhouseCluster` to include SSL/TLS configuration. - **snuba/migrations/runner.py**: Added SSL/TLS parameters to migration runner. - **snuba/settings/__init__.py**: Added SSL/TLS configuration options. - **snuba/settings/settings_distributed.py**: Added SSL/TLS configuration options. - **tests/clusters/fake_cluster.py**: Updated `FakeClickhouseCluster` to include SSL/TLS parameters. - **tests/clusters/test_cluster.py**: Updated tests to include SSL/TLS configuration. - **tests/conftest.py**: Updated test setup to include SSL/TLS configuration. - **tests/migrations/test_connect.py**: Updated tests to include SSL/TLS configuration. - **tests/migrations/test_table_engines.py**: Updated tests to include SSL/TLS configuration. - **tests/replacer/test_cluster_replacements.py**: Updated tests to include SSL/TLS configuration. ## Related Issues - #6458 ## Related Pull Requests: - #2018 - #2033 ### Additional Notes - This change is backward compatible and does not require any additional setup for users who do not wish to enable SSL/TLS. - Please review the changes carefully to ensure that the SSL/TLS implementation is secure and efficient. FYI @konstantin-popov Thank you for reviewing this pull request! ### Legal Boilerplate Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms. --------- Co-authored-by: Markus Unterwaditzer <[email protected]> Co-authored-by: Markus Unterwaditzer <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Title: Error Connecting to ClickHouse with SSL Port: Unexpected Packet from Server
Description:
When attempting to connect to ClickHouse using the SSL port (e.g.,
9440
), the Snuba project throws an error indicating an unexpected packet from the server. This issue occurs during the migration process when Snuba tries to execute a query to check the ClickHouse connection.Steps to Reproduce:
9440
.Expected Behavior:
Snuba should successfully connect to ClickHouse using the SSL port and proceed with the migration process.
Actual Behavior:
The following error is thrown:
Suggested Fix:
It appears that Snuba might not be handling the SSL connection properly, leading to the unexpected packet error. A potential fix could involve ensuring that the SSL configuration is correctly passed to the ClickHouse client and that the client is properly initialized for SSL connections.
Related PR:
Logs:
The text was updated successfully, but these errors were encountered: