Repository navigation
Conversation
When dfdaemon connects to schedulers with TLS enabled, Scheduler::load_client_tls_config sets ClientTlsConfig::domain_name to the host of the dial URL, which is always the scheduler IP address. If the scheduler TLS certificate contains only DNS Subject Alternative Names (SANs) rather than IP SANs, TLS verification fails during handshake. Add an optional server_name field to Scheduler config (serde serverName). When set, Scheduler::load_client_tls_config uses this value as the TLS domain name for certificate verification, falling back to the dial host IP when unset. Add unit tests for configuration deserialization and TLS domain name resolution. Signed-off-by: Simone Primarosa <simone.primarosa@gmail.com>
simonepri
requested review from
ClementMaH,
Zephyrcf,
fcgxz2003,
hyy0322,
xujihui1985 and
yyzai384
October 8, 2026 06:45
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2089 +/- ##
==========================================
+ Coverage 65.29% 65.37% +0.07%
==========================================
Files 103 103
Lines 30789 30860 +71
==========================================
+ Hits 20105 20176 +71
Misses 10684 10684
🚀 New features to boost your workflow:
|
dfdaemon dials peers and seed peers by IP, so UploadClient::load_client_tls_config verifies their certificates against the peer IP. Peer certificates with DNS SANs only fail the handshake, the same way scheduler certificates did. Add an optional server_name field to UploadClient config (serde serverName). When set, it is used as the TLS domain name for verifying peer certificates, falling back to the dial host when unset. Signed-off-by: Simone Primarosa <simone.primarosa@gmail.com>
Contributor
Author
|
gaius-qi@ LunaWhispers@ small follow up of #1859 to make the mTSL setup work. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add an optional
serverNamefield to the scheduler TLS config (scheduler) and the peer TLS config (upload.client). When set,load_client_tls_configuses it as the TLS domain name for verifying the scheduler, peer or seed peer certificate. When unset, behavior is unchanged: the host of the dial URL is used.Unit tests cover deserializing
serverNamefor both configs and thatload_client_tls_configprefers it over the dial host.Related Issue
Fixes #2088
Follow-up to #1859, which made dfdaemon dial schedulers over https when TLS is configured. With that fix in place, the handshake now reaches certificate verification, which fails against DNS-only scheduler certificates.
Motivation and Context
dfdaemon dials schedulers, peers and seed peers by IP, so it verifies their certificates against that IP. On Kubernetes, these certificates usually carry DNS SANs only, because pod and node IPs change. With mTLS on, every connection then fails with
tls: bad certificate. SettingserverNameto a name in the certificate lets DNS-only certificates verify, for example one shared peer certificate for every dfdaemon.