6651c14adc
m11p7 — secure the cluster, all opt-in (pre-m11p7 byte-for-byte):
- gRPC replication mTLS by default via a custom tokio-rustls acceptor +
DynamicCertResolver; zero-drop content-hash cert rotation (k8s ..data swap,
no pod restart, no inotify)
- inter-node HTTP TLS sharing the same resolver (one rotation, both planes) +
per-node keyed-BLAKE3 signed x-tidal-node-token; marker-without-token -> 403
- admin audit log (operator-leg only) + per-principal rate limit (engine
RateLimiter; sibling nodes exempt)
- k8s cert-manager manifest (certs.yaml) + scripts/gen-cluster-certs.sh fallback;
secret.example.yaml gains TIDAL_CLUSTER_KEY (file-mounted, hot-rotatable)
- exit gate verified real: mtls.rs (gRPC foreign-pod), cluster_security.rs
(HTTP foreign + zero-drop rotation under load), 7 security unit tests
perf — instrument floor (sweep Wave 1):
- new tidal/benches/wal.rs + tidal-server/benches/scatter.rs
- p99->mean honesty relabel; sweep manifest at docs/reviews/perf-sweep-2026-06-13.md
- add @tidal-performance agent (Martin Thompson)
new: cluster/{audit,http_tls,security}.rs, tests/cluster_security.rs,
docs/planning/milestone-11/phase-7.md
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
# tidalDB CLUSTER deployment (m11p5 §4). Apply with:
|
|
# kubectl apply -k k8s/cluster/
|
|
#
|
|
# MUTUALLY EXCLUSIVE with the standalone set (k8s/, namespace `tidaldb`). This
|
|
# set lives in namespace `tidaldb-cluster`. Deploy ONE or the OTHER per
|
|
# namespace — never both (they share the StatefulSet name `tidaldb` and the
|
|
# standalone set's replicas:1 is load-bearing).
|
|
#
|
|
# Create the credentials secret FIRST (deliberately excluded so no key is
|
|
# committed — see secret.example.yaml). m11p7 shape carries BOTH the bearer and
|
|
# the cluster key:
|
|
# kubectl -n tidaldb-cluster create secret generic tidaldb-credentials \
|
|
# --from-literal=TIDAL_API_KEY="$(openssl rand -hex 32)" \
|
|
# --from-literal=TIDAL_CLUSTER_KEY="$(openssl rand -hex 32)"
|
|
#
|
|
# certs.yaml (m11p7 inter-node TLS) requires cert-manager. If you do NOT run
|
|
# cert-manager, comment certs.yaml out and provision the `tidaldb-cluster-tls`
|
|
# Secret with scripts/gen-cluster-certs.sh instead.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: tidaldb-cluster
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- schema-configmap.yaml
|
|
- topology-configmap.yaml
|
|
- certs.yaml
|
|
- service-peers.yaml
|
|
- service-client.yaml
|
|
- statefulset.yaml
|
|
- poddisruptionbudget.yaml
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/part-of: tidaldb
|
|
includeSelectors: false
|