[DPE-7899] 8.4 - Migrate to TLS v4 (I) by sinclert-canonical · Pull Request #248 · canonical/mysql-operators

sinclert-canonical · 2026-04-16T13:02:23Z

This PR migrates the handling of TLS certificates to use version 4 of the tls-certificates interface.

The library used to deal with version 4 of such interface was initially published as a charmlib, but then ported to a pure Python package within the charmlibs repository, to be published and consumed via PyPi. Despite the package current version (1.X.Y), it is shipping version 4 of the interface.

Approach:

The new interface version allow us to simplify the current logic by skipping any certificate expiration event handling. This is now managed by the provider automatically, so the only event we need to handle is CertificateAvailable.

Future work:

Enable peer-to-peer encryption by enabling the group replication SSL.
Define the necessary logic to parse a manually configured private key for TLS certificates generation.

sinclert-canonical · 2026-04-17T12:07:05Z

+        except RuntimeError:
+            logger.warning("Unit DNS domain name is not propagated yet")
+            return ""


This is required so that the TLS class initialization does not crash when the charm does not has any of the expected relations (database, database-peers, replication, replication-offer). This usually happens at the very early stages of a charm deployment, or during unit tests.

Should we defer instead. I not sure how cert request behave with a "" SAN

I am not entirely sure how to do so: the function does not received any event to defer upon 🤔

Regardless, these host-names will only be used when the group-replication encryption mode is set to VERIFY_IDENTITY (see docs), which we are far from using. The code is here to mimic PostgreSQL way of dealing with certificate generation.

Good point. I'd say then to not include the empty str in the SAN set.

Avoiding the empty string is already managed here, similarly to PostgreSQL implementation (see code).

What about moving this try...except one level up then? Not a fan of that return ""

paulomach

Nice. Couple open questions, minor catches

paulomach · 2026-04-22T09:46:42Z

+        except RuntimeError:
+            logger.warning("Unit DNS domain name is not propagated yet")
+            return ""


Should we defer instead. I not sure how cert request behave with a "" SAN

sinclert-canonical · 2026-04-23T13:57:13Z

🗞️ PR branch rebased from 8.4/edge. This is ready for review again.

paulomach

No blocker from my side! Nice work

astrojuanlu

Left a few nits, leaving those to your discretion. Otherwise LGTM!

astrojuanlu · 2026-04-24T15:13:10Z

+        — CA file should have a full chain.
+        — Key file should have private key.
+        — Certificate file should have certificate without certificate chain.


Suggested change

— CA file should have a full chain.

— Key file should have private key.

— Certificate file should have certificate without certificate chain.

- CA file should have a full chain.

- Key file should have private key.

- Certificate file should have certificate without certificate chain.

?

astrojuanlu · 2026-04-24T15:32:53Z

+        except MySQLTLSSetupError:
+            logger.error("Failed to enable TLS configuration.")


Any problem with retaining the original context for debugging?

Suggested change

except MySQLTLSSetupError:

logger.error("Failed to enable TLS configuration.")

except MySQLTLSSetupError as exc:

logger.error(f"Failed to enable TLS configuration: {exc}")

Or even logger.exception to show the full traceback

astrojuanlu · 2026-04-24T15:33:30Z

+        except MySQLTLSSetupError:
+            logger.error("Failed to disable TLS configuration.")


Same as above:

Suggested change

except MySQLTLSSetupError:

logger.error("Failed to disable TLS configuration.")

except MySQLTLSSetupError as exc:

logger.error(f"Failed to disable TLS configuration: {exc}")

sinclert-canonical added the enhancement New feature, UI change, or workload upgrade label Apr 16, 2026

github-actions Bot added the Libraries: Out of sync The charm libs used are out-of-sync label Apr 16, 2026

github-code-quality Bot found potential problems Apr 16, 2026

View reviewed changes

sinclert-canonical force-pushed the sinclert/7899/tls-v4-part-1 branch from 7ae46b1 to aa07e3e Compare April 16, 2026 15:35

sinclert-canonical commented Apr 17, 2026

View reviewed changes

Comment thread machines/src/charm.py

sinclert-canonical force-pushed the sinclert/7899/tls-v4-part-1 branch 3 times, most recently from 436a30b to f4c48c0 Compare April 21, 2026 14:55

sinclert-canonical marked this pull request as ready for review April 22, 2026 09:00

sinclert-canonical requested review from astrojuanlu and paulomach April 22, 2026 09:00

paulomach reviewed Apr 22, 2026

View reviewed changes

sinclert-canonical marked this pull request as draft April 22, 2026 10:31

sinclert-canonical force-pushed the sinclert/7899/tls-v4-part-1 branch from d4512d1 to 267e79f Compare April 23, 2026 10:01

sinclert-canonical marked this pull request as ready for review April 23, 2026 10:07

sinclert-canonical force-pushed the sinclert/7899/tls-v4-part-1 branch 2 times, most recently from 5d69742 to 5a87f5b Compare April 23, 2026 12:42

sinclert-canonical requested a review from paulomach April 23, 2026 13:36

sinclert-canonical added 9 commits April 23, 2026 15:53

[Docs] Refactor TLS docs

65e8a52

[K8s] Replace TLS charmlib by PyPi lib

2cf8f99

[K8s] Remove TLS charmlib

2ac6b3c

[K8s] Define TLS relation handler

1421e39

[K8s] Disable TLS rotation test

1232ed9

[VM] Replace TLS charmlib by PyPi lib

06dea96

[VM] Remove TLS charmlib

11c1e3d

[VM] Define TLS relation handler

e29446e

[VM] Disable TLS rotation test

5758b15

sinclert-canonical force-pushed the sinclert/7899/tls-v4-part-1 branch from 5a87f5b to 5758b15 Compare April 23, 2026 13:56

paulomach approved these changes Apr 24, 2026

View reviewed changes

astrojuanlu approved these changes Apr 24, 2026

View reviewed changes

		except MySQLTLSSetupError:
		logger.error("Failed to enable TLS configuration.")

		except MySQLTLSSetupError:
		logger.error("Failed to disable TLS configuration.")

Conversation

sinclert-canonical commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approach:

Future work:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

paulomach left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sinclert-canonical commented Apr 23, 2026

Uh oh!

paulomach left a comment

Choose a reason for hiding this comment

Uh oh!

astrojuanlu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sinclert-canonical commented Apr 16, 2026 •

edited

Loading