Metabase needs TLS enabled for its mariadb connection.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| In Progress | greg | T377362 EPIC: Trino/MinIO/Hive-Standalone-Metaserver/Dagster/Metabase/Superset Implementation | |||
| Resolved | Dwisehaupt | T377363 EPIC: Metabase Implementation | |||
| Resolved | Jgreen | T385813 [Metabase] Enable TLS for mariadb connection. |
Event Timeline
Comment Actions
For data source connections, adding the CA certificate to "Server SSL certificate chain" in the UI database setup works. It would be better to reference a file i.e. with a JDBC connection string option, but I haven't found a way to do that yet.
Update: found it!
serverSslCert=/etc/mysql/cacert.pem
Note there's an informational message in the logs with this setting enabled:
driver.mysql :: You may need to add 'trustServerCertificate=true' to the additional connection options to connect with SSL.
So far it doesn't look like we need this, but putting it here so I don't forget.
Comment Actions
For the application database:
MB_DB_CONNECTION_URI=jdbc:mysql://<%= @db_user -%>:<%= @db_password -%>@<%= @db_host -%>:<%= @db_port -%>/<%= @db_name -%>?useSSL=true&trustServerCertificate=false&serverSslCert=<%= @db_ca_cert %>
Comment Actions
This is done. Note that Metabase logs the entire connection string if there's connection error, which is problematic and needs further investigation. Also a password string with an '@' etc breaks things.
Comment Actions
Reopening because it looks like we can move the password out of MB_DB_CONNECTION_URI so we don't log it on a connection error: https://github.com/metabase/metabase/pull/20135
Comment Actions
User/password have been removed from MB_DB_CONNECTION_URI to separate environment variables.