hubcio opened a new pull request, #3425: URL: https://github.com/apache/iggy/pull/3425
The server-ng replica port (tcp_replica) was plaintext: any TCP peer that learned the cluster id could inject VSR frames or register as an arbitrary replica. mTLS does not fit - the replica conn is a dup'd plaintext fd round-robined across shards, state rustls cannot carry. Authenticate instead with a pre-shared cluster key and a 3-message mutual BLAKE3 keyed-MAC handshake over the reserved Ping/Pong header bytes: no new wire type, the stream stays a dupable plaintext fd. The MAC proves PSK possession (cluster membership, not per-replica identity - the registry still trusts the Ping id, so keep the port on a trusted boundary). The PSK is never serialized to disk. A typed Nack lets a rejected joiner learn why from its own logs. Configured under [cluster.auth] (enabled, shared_secret): enabled = authenticate and enforce, off = legacy. Coordinated-restart change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
