You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
144181: security: cleanup clientcert expiration cache functionality r=angles-n-daemons a=angles-n-daemons
security: cleanup clientcert expiration cache functionality
The work done for #142686 in #143081 was truncated to make the changeset more backportable. Some of the modifications held are ported instead to this PR, so that extra functions are removed, and the `clientcert/cache.go` is simpler in terms of its responsibility. The changes include:
- A simplified interface for creating an managing the client certificate cache.
- Removes some of the extra code used for getting and checking times.
- Removes the (now unused) cluster setting for limiting the size of the cache.
- Removes the (unused and unsafe) getters from the cache, ports the tests to reading the values from the metrics.
Fixes: #144163
Epic: none
Release note (ops change): cluster setting
`server.client_cert_expiration_cache.capacity` has been deprecated. The client certificate cache now evicts client certificates based on time.
144714: builder: install a more recent version of `patchelf` r=rail a=rickystewart
The version previously in use produces buggy results on s390x.
Epic: CRDB-21133
Release note: None
144843: sql: honour RLS policies during query-based backfill r=spilchen a=spilchen
Previously, schema changes that performed backfill operations from a query—such as those for materialized views (MQTs) or CREATE TABLE ... AS (CTAS)—executed the query as the node user. This user has administrative privileges and bypasses all Row-Level Security (RLS) policies, unintentionally exposing rows the originator of the change should not have been able to access.
This change ensures that such query-based backfills run under the privileges of the user who initiated the schema change. As a result, RLS policies are correctly enforced, and only the rows visible to the initiating user are included in the result.
Fixes#144816Fixes#144776
Epic: CRDB-11724
Release note: none
144873: sql: enable TestUpsertFastPath with buffered writes r=arulajmani a=arulajmani
We're able to hit 1PC in more cases when buffered writes are enabled. Teach TestUpsertFastPath about it.
Epic: none
Release note: None
Co-authored-by: Brian Dillmann <[email protected]>
Co-authored-by: Ricky Stewart <[email protected]>
Co-authored-by: Matt Spilchen <[email protected]>
Co-authored-by: Arul Ajmani <[email protected]>
server.authentication_cache.enabled boolean true enables a cache used during authentication to avoid lookups to system tables when retrieving per-user authentication-related information application
116
116
server.child_metrics.enabled boolean false enables the exporting of child metrics, additional prometheus time series with extra labels application
117
117
server.child_metrics.include_aggregate.enabled boolean true include the reporting of the aggregate time series when child metrics are enabled. This cluster setting has no effect if child metrics are disabled. application
118
-
server.client_cert_expiration_cache.capacity integer 1000 the maximum number of client cert expirations stored application
119
118
server.clock.forward_jump_check.enabled (alias: server.clock.forward_jump_check_enabled) boolean false if enabled, forward clock jumps > max_offset/2 will cause a panic application
120
119
server.clock.persist_upper_bound_interval duration 0s the interval between persisting the wall time upper bound of the clock. The clock does not generate a wall time greater than the persisted timestamp and will panic if it sees a wall time greater than this value. When cockroach starts, it waits for the wall time to catch-up till this persisted timestamp. This guarantees monotonic wall time across server restarts. Not setting this or setting a value of 0 disables this feature. application
121
120
server.eventlog.enabled boolean true if set, logged notable events are also stored in the table system.eventlog application
Copy file name to clipboardExpand all lines: docs/generated/settings/settings.html
-1Lines changed: 0 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -146,7 +146,6 @@
146
146
<tr><td><divid="setting-server-authentication-cache-enabled" class="anchored"><code>server.authentication_cache.enabled</code></div></td><td>boolean</td><td><code>true</code></td><td>enables a cache used during authentication to avoid lookups to system tables when retrieving per-user authentication-related information</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
147
147
<tr><td><divid="setting-server-child-metrics-enabled" class="anchored"><code>server.child_metrics.enabled</code></div></td><td>boolean</td><td><code>false</code></td><td>enables the exporting of child metrics, additional prometheus time series with extra labels</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
148
148
<tr><td><divid="setting-server-child-metrics-include-aggregate-enabled" class="anchored"><code>server.child_metrics.include_aggregate.enabled</code></div></td><td>boolean</td><td><code>true</code></td><td>include the reporting of the aggregate time series when child metrics are enabled. This cluster setting has no effect if child metrics are disabled.</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
149
-
<tr><td><divid="setting-server-client-cert-expiration-cache-capacity" class="anchored"><code>server.client_cert_expiration_cache.capacity</code></div></td><td>integer</td><td><code>1000</code></td><td>the maximum number of client cert expirations stored</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
150
149
<tr><td><divid="setting-server-clock-forward-jump-check-enabled" class="anchored"><code>server.clock.forward_jump_check.enabled<br/>(alias: server.clock.forward_jump_check_enabled)</code></div></td><td>boolean</td><td><code>false</code></td><td>if enabled, forward clock jumps > max_offset/2 will cause a panic</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
151
150
<tr><td><divid="setting-server-clock-persist-upper-bound-interval" class="anchored"><code>server.clock.persist_upper_bound_interval</code></div></td><td>duration</td><td><code>0s</code></td><td>the interval between persisting the wall time upper bound of the clock. The clock does not generate a wall time greater than the persisted timestamp and will panic if it sees a wall time greater than this value. When cockroach starts, it waits for the wall time to catch-up till this persisted timestamp. This guarantees monotonic wall time across server restarts. Not setting this or setting a value of 0 disables this feature.</td><td>Serverless/Dedicated/Self-Hosted</td></tr>
152
151
<tr><td><divid="setting-server-consistency-check-max-rate" class="anchored"><code>server.consistency_check.max_rate</code></div></td><td>byte size</td><td><code>8.0 MiB</code></td><td>the rate limit (bytes/sec) to use for consistency checks; used in conjunction with server.consistency_check.interval to control the frequency of consistency checks. Note that setting this too high can negatively impact performance.</td><td>Dedicated/Self-Hosted</td></tr>
![craig[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png?size=40){kind=avatar}
0 commit comments