A Smooth Sea Never Made a Skillful Sailor

CockroachDB Dedicated comes with TLS enabled by default. At the minimum, a certificate authority is needed to authenticate. A customer was having issues using Flyway and TLS. My previous articles on schema migrations and CockroachDB Migrating feature toggles with Unleash and CockroachDB Motivation A prospect was having issues with TLS and Flyway schema migrations and since both topics are near and dear to my heart I felt obligated to respond. High Level Steps Deploy a CockroachDB Dedicated cluster Configure Flyway Verify Demonstrate the problem Step by step instructions Deploy a CockroachDB Dedicated cluster Spinning up a CockroachDB Dedicated cluster is fairly straight forward. Follow this guide . Configure Flyway Setting up a Flyway migration depends on your deployment model. I don't use any sophisticated CI/CD pipeline and rely on Docker for my needs. I'm also using the community edition and limited to certain capabilities. You need a flyway director...

This is my series of articles covering short "Today I learned" topics as I work with CockroachDB. Today, we're diagnosing cert issues, looking at client verification of server certificates differences in the cockroach and the psql clients, and checking the node and the CA certificate expiration programmatically. Previous articles Volume 1 Volume 2 Volume 3 Volume 4 Volume 5 Volume 6 Volume 7 Volume 8 Volume 9 Volume 10 Volume 11 Volume 12 Topics Topic 1: Diagnose certificate based authentication Topic 2: Differences between cockroach and psql clients for client verification of server certificates Topic 3: Capture the node and the CA certificate expiration programmatically Topic 4: Check the client certificate expiration Topic 1: Diagnose certificate based authentication I was using CockroachDB Serverless with a product called PolyScale.ai for an article I was writing and I've run into a strange issue with certificate-based authN. ...

Today, I'm going to talk about means of using Django with a kerberized CockroachDB and what that entails. This is not uncommon in a production use case and expecting enterprise-grade access to development frameworks is table stakes for some of our customers.

Today, I am going to discuss CockroachDB integration with Active Directory. AD is the commercial brother of Kerberos maintained by Microsoft. AD is a de facto authentication standard across large enterprises and our customers expect products calling themselves enterprise to work seamlessly with Active Directory. Hence, here's my write-up with end to end steps to deploy a lab environment to try on your own.

CockroachDB out of the box comes with ability to generate certificates with cockroach cert command. This command will provision certs for client and nodes. One common gap we get from our customers is the explicit reliance on CN=node and CN=root . In our latest development release, we're introducing ability to map root and node principals to custom CNs. The process bypasses cockroach cert command in favor of openssl utility. It is very well documented and I recorded a live walk-through of the entire process. I am including my openssl configuration files for convenience: ca.cnf # OpenSSL CA configuration file [ ca ] default_ca = CA_default [ CA_default ] default_days = 365 database = index.txt serial = serial.txt default_md = sha256 copy_extensions = copy unique_subject = no # Used to create the CA certificate. [ req ] prompt=no distinguished_name = distinguished_name x509_extensions = extensions [ distinguished_name ] organizationName = Example Inc commonName = Exampl...