Feature Request

Description

At present, when deploying a cluster with tiup-cluster, the tidb cluster (tidb <-> pd <-> tikv and pd <-> tiup) use plain messages to communicate, this may lead to potential security leaks. We should support TLS encryption as an option in the cluster topology to enable TLS encryption among components.

Similar support is already implemented in tidb-ansible and tidb-operator.

Catagory

Security

Value

Increase security of TiDB cluster, and avoid potential security leaks like MITM attack.

TODO List

• Add support of TLS encryption in specs
  • PD
  • TiKV
  • TiDB (Both server and client)
  • Pump / Drainer
  • CDC
  • binlog
  • Conflict validation with unsupported components
• Generate TLS certificates and correct configs for components
• Support API calls with TLS encryption enabled

Schedule

GanttStart: 2020-08-01
GanttDue: 2020-08-31
GanttProgress: 95%