You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shardingsphere.apache.org by GitBox <gi...@apache.org> on 2021/06/24 11:05:14 UTC
[GitHub] [shardingsphere] strongduanmu opened a new issue #10996: Support encrypt route when config multiple data sources
strongduanmu opened a new issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996
## Background
Now encrypt can be used alone or in combination with other features, like sharding, readwrite-splitting, etc. When encrypt is used alone, it only supports a single data source, and does not support multiple data sources. When encrypt is used in combination, it does not support separate configuration of data sources, it must needs to rely on data sources that configured by other features.
Since `DistSQL` separates resources (data sources) and rules, there must be scenarios where there are multiple data sources when creating encrypt rules. Therefore, it is necessary to support multiple data sources and add routing logic to support multiple data source routing.
The new encrypt configuration is as follows:
```yaml
dataSources:
ds_0:
url: jdbc:mysql://127.0.0.1:3306/demo_ds_0?serverTimezone=UTC&useSSL=false
username: root
password: 123456
connectionTimeoutMilliseconds: 30000
idleTimeoutMilliseconds: 60000
maxLifetimeMilliseconds: 1800000
maxPoolSize: 50
minPoolSize: 1
maintenanceIntervalMilliseconds: 30000
ds_1:
url: jdbc:mysql://127.0.0.1:3306/demo_ds_1?serverTimezone=UTC&useSSL=false
username: root
password: 123456
connectionTimeoutMilliseconds: 30000
idleTimeoutMilliseconds: 60000
maxLifetimeMilliseconds: 1800000
maxPoolSize: 50
minPoolSize: 1
maintenanceIntervalMilliseconds: 30000
rules:
- !ENCRYPT
encryptors:
aes_encryptor:
type: AES
props:
aes-key-value: 123456abc
md5_encryptor:
type: MD5
tables:
t_encrypt:
columns:
user_id:
plainColumn: user_plain
cipherColumn: user_cipher
encryptorName: aes_encryptor
order_id:
cipherColumn: order_cipher
encryptorName: md5_encryptor
```
SS will route internally according to the single table rule and decide which data source to route to.
## Task
- [ ]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-888858430
In order to solve the single table routing in the multi-data source aggregation scenario, the order of the rule needs to be adjusted. The latest order is as follows.
<div class="okr-block-clipboard" data-okr="%7B%22okrDelta%22%3A%5B%7B%22lineType%22%3A%22unsupport%22%2C%22lineOptions%22%3A%7B%7D%2C%22lineContent%22%3A%5B%5D%7D%5D%2C%22businessKey%22%3A%22lark-doc%22%7D"></div><div data-zone-id="0" data-line-index="0" style="white-space: pre;">
Type | Order | Use
-- | -- | --
ShardingRule | ShardingOrder——0 | ShardingTableMetaDataBuilder ShardingSQLRewriteContextDecorator ShardingResultMergerEngine ShardingSQLRouter
SingleTableRule | SingleTableOrder——10 | SingleTableSQLRouter
EncryptRule | EncryptOrder——20 | EncryptTableMetaDataBuilder EncryptSQLRewriteContextDecorator EncryptResultDecoratorEngine
ReadwriteSplittingRule | ReadwriteSplittingOrder——30 | ReadwriteSplittingSQLRouter
DatabaseDiscoveryRule | DatabaseDiscoveryOrder——40 | DatabaseDiscoverySQLRouter
ShadowRule | ShadowOrder——50 | ShadowSQLRewriteContextDecorator ShadowSQLRouter
</div>
As shown in the figure below, the kernel execution will be executed in ascending order of order.
When the rule is initialized, the data source aggregation rule needs to be loaded in reverse order to ensure that it can be routed from the logical data source to the real data source during routing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-889728838
When using encrypt, update `t_encrypt` table and find that the FederateSchemaMetadata data is maintained incorrectly, and the real metadata should be loaded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu closed issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu closed issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-893201576
After a discussion, we decided to revert the `DistributedSchemaRuleBuilder` and `EnhancedSchemaRuleBuilder` SPI interfaces, and add the `DistributedRuleConfiguration` and `EnhancedRuleConfiguration` interfaces to distinguish different types of rules and determining the load order of the rules.
At the same time, there is a conflict between the implementation of `SingleTableRule` and the pluggable architecture concept. It needs to be adjusted from `FeatureRule` to `KernelRule`, and order is adjusted to `0`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-888858430
In order to solve the single table routing in the multi-data source aggregation scenario, the order of the rule needs to be adjusted. The latest order is as follows.
<div class="okr-block-clipboard" data-okr="%7B%22okrDelta%22%3A%5B%7B%22lineType%22%3A%22unsupport%22%2C%22lineOptions%22%3A%7B%7D%2C%22lineContent%22%3A%5B%5D%7D%5D%2C%22businessKey%22%3A%22lark-doc%22%7D"></div><div data-zone-id="0" data-line-index="0" style="white-space: pre;">
Type | Order | Use
-- | -- | --
ShardingRule | ShardingOrder——-10 | ShardingTableMetaDataBuilder ShardingSQLRewriteContextDecorator ShardingResultMergerEngine ShardingSQLRouter
SingleTableRule | SingleTableOrder——0 | SingleTableSQLRouter
EncryptRule | EncryptOrder——10 | EncryptTableMetaDataBuilder EncryptSQLRewriteContextDecorator EncryptResultDecoratorEngine
ReadwriteSplittingRule | ReadwriteSplittingOrder——20 | ReadwriteSplittingSQLRouter
DatabaseDiscoveryRule | DatabaseDiscoveryOrder——30 | DatabaseDiscoverySQLRouter
ShadowRule | ShadowOrder——40 | ShadowSQLRewriteContextDecorator ShadowSQLRouter
</div>
As shown in the figure below, the kernel execution will be executed in ascending order of order.
When the rule is initialized, the data source aggregation rule needs to be loaded in reverse order to ensure that it can be routed from the logical data source to the real data source during routing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] terrymanu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
terrymanu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-892010853
Please pending this issue.
The rule builders of Distributed and Enhanced are not for SchemaRuleBuilder only.
GlobalRuleBuilder still has Distributed and Enhanced abilities.
Because of add lots of extra interface of builder the current modification, it make a little confuse and add more complex for understanding.
It is better to redesign the domain concepts.
The interface API and SPI(SchemaRuleBuilder is the most important SPI for adding new feature) should not change frequently. We need to design in the kernel and hide the changes to end-users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] terrymanu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
terrymanu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-892010853
Please pending this issue.
The rule builders of Distributed and Enhanced are not for SchemaRuleBuilder only.
GlobalRuleBuilder still has Distributed and Enhanced abilities.
Because of adding lots of extra interfaces of builder in the current modification, it make a little confuse and add more complex for understanding.
It is better to redesign the domain concepts.
The interface API and SPI(SchemaRuleBuilder is the most important SPI for adding new feature) should not change frequently. We need to design in the kernel and hide the changes to end-users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-888858430
In order to solve the single table routing in the multi-data source aggregation scenario, the order of the rule needs to be adjusted. The latest order is as follows.
<div class="okr-block-clipboard" data-okr="%7B%22okrDelta%22%3A%5B%7B%22lineType%22%3A%22unsupport%22%2C%22lineOptions%22%3A%7B%7D%2C%22lineContent%22%3A%5B%5D%7D%5D%2C%22businessKey%22%3A%22lark-doc%22%7D"></div><div data-zone-id="0" data-line-index="0" style="white-space: pre;">
Type | Order | Use
-- | -- | --
ShardingRule | ShardingOrder——-10 | ShardingTableMetaDataBuilder ShardingSQLRewriteContextDecorator ShardingResultMergerEngine ShardingSQLRouter
SingleTableRule | SingleTableOrder——0 | SingleTableSQLRouter
EncryptRule | EncryptOrder——10 | EncryptTableMetaDataBuilder EncryptSQLRewriteContextDecorator EncryptResultDecoratorEngine
ReadwriteSplittingRule | ReadwriteSplittingOrder——20 | ReadwriteSplittingSQLRouter
DatabaseDiscoveryRule | DatabaseDiscoveryOrder——30 | DatabaseDiscoverySQLRouter
ShadowRule | ShadowOrder——40 | ShadowSQLRewriteContextDecorator ShadowSQLRouter
</div>
As shown in the figure below, the kernel execution will be executed in ascending order of order.
When the rule is initialized, the data source aggregation rule needs to be loaded in reverse order to ensure that it can be routed from the logical data source to the real data source during routing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] terrymanu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
terrymanu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-892010853
Please pending this issue.
The rule builder Distributed RuleBuilder and Enhanced RuleBuilder is not for schemaRuleBuilder only.
GlobalRuleBuilder still has Distributed and Enhanced abilities.
The current modification make confuse and add lots of extra interface of builder.
It is better to redesign the domain concepts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-902382181
All work has been completed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] terrymanu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
terrymanu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-892010853
Please pending this issue.
The rule builders of Distributed and Enhanced are not for SchemaRuleBuilder only.
GlobalRuleBuilder still has Distributed and Enhanced abilities.
Because of adding lots of extra interfaces of builder in the current modification, it make a little confuse and add more complex for understanding.
It is better to redesign the domain concepts.
The interface of API and SPI (SchemaRuleBuilder is the most important SPI for adding new feature) should not change frequently. We need to design in the kernel and hide the changes to end-users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-894158173
When I use the encrypt feature alone and configure multiple data sources, refresh the metadata after executing create table statement, there is a certain probability that it will fail. When Encrypt loads metadata, it always selects the first data source, which results in that metadata cannot be loaded when distributed to other data sources.
```java
/**
* Table meta data builder for encrypt.
*/
public final class EncryptTableMetaDataBuilder implements RuleBasedTableMetaDataBuilder<EncryptRule> {
@Override
public Optional<TableMetaData> load(final String tableName, final DatabaseType databaseType, final Map<String, DataSource> dataSourceMap, final DataNodes dataNodes,
final EncryptRule encryptRule, final ConfigurationProperties props) throws SQLException {
return encryptRule.findEncryptTable(tableName).isPresent() ? TableMetaDataLoader.load(dataSourceMap.values().iterator().next(), tableName, databaseType) : Optional.empty();
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-890785146
When I tested the read-write separation scenario and configured multiple data, the metadata was incorrectly loaded during single table refresh.
```java
private TableMetaData loadTableMetaData(final String tableName, final Collection<String> routeDataSourceNames,
final SchemaBuilderMaterials materials) throws SQLException {
for (String routeDataSourceName : routeDataSourceNames) {
DataSource dataSource = materials.getDataSourceMap().get(routeDataSourceName);
Optional<TableMetaData> tableMetaDataOptional = Objects.isNull(dataSource) ? Optional.empty()
: TableMetaDataLoader.load(dataSource, tableName, materials.getDatabaseType());
if (!tableMetaDataOptional.isPresent()) {
continue;
}
return tableMetaDataOptional.get();
}
return new TableMetaData();
}
```
The `routeDataSourceNames` parameter passes the logical data source name, and `materials.getDataSourceMap()` returns the real data source name in the configuration file, so you need to convert routeDataSourceNames to the real data source name, otherwise abnormal results will occur when the metadata refreshes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu edited a comment on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu edited a comment on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-889728838
When using encrypt, update `t_encrypt` table and find that the FederateSchemaMetadata data is maintained incorrectly, and the real metadata should be loaded.
FederateSchemaMetadata metadata maintenance errors will cause non-existent columns to appear when the Federate execution engine is used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shardingsphere] strongduanmu commented on issue #10996: Support encrypt route when config multiple data sources
Posted by GitBox <gi...@apache.org>.
strongduanmu commented on issue #10996:
URL: https://github.com/apache/shardingsphere/issues/10996#issuecomment-893201576
After a discussion, we decided to revert the `DistributedSchemaRuleBuilder` and `EnhancedSchemaRuleBuilder` SPI interfaces, and add the `DistributedRuleConfiguration` and `EnhancedRuleConfiguration` interfaces to distinguish different types of rules and determining the load order of the rules.
At the same time, there is a conflict between the implementation of `SingleTableRule` and the pluggable architecture concept. It needs to be adjusted from `FeatureRule` to `KernelRule`, and order is adjusted to `0`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org