feat(ibis): Added BE Support for MySQL SSL Connection #1024
Conversation
WalkthroughThe pull request introduces enhanced SSL configuration support for MySQL connections in the Ibis server. Two new optional fields, Changes
Sequence DiagramsequenceDiagram
participant Client
participant DataSourceExtension
participant SSLContext
participant MySQLConnection
Client->>DataSourceExtension: get_mysql_connection(info)
DataSourceExtension->>SSLContext: _create_ssl_context(info)
alt SSL Disabled
SSLContext-->>DataSourceExtension: None
else SSL Required
SSLContext-->>DataSourceExtension: SSLContext(CERT_NONE)
else Verify CA
SSLContext-->>DataSourceExtension: SSLContext(CERT_REQUIRED)
end
DataSourceExtension->>MySQLConnection: Establish Connection
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
ibis-server/app/model/__init__.py (1)
98-99: Consider using an enum or a standard string field forssl_modeCurrently,
ssl_modeis stored as aSecretStr. While keeping credentials secret makes sense forssl_ca, the SSL mode is typically not sensitive data. It might be more straightforward to definessl_modeas either a string or an explicit Enum field instead, so that validation can occur at the schema level (rather than relying on the_create_ssl_contextmethod to interpret the internal string value).ibis-server/app/model/data_source.py (1)
35-38: Use a consistent naming convention for Enum valuesThe enum values
"Disable","Require", and"Verify CA"are descriptive. However, it might be clearer to maintain a consistent format—e.g., all uppercase with underscores such asDISABLE,REQUIRE,VERIFY_CA—when referencing them in-line or in code. This is a Nitpick, but consistency can help avoid typos and confusion.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
ibis-server/app/model/__init__.py(1 hunks)ibis-server/app/model/data_source.py(4 hunks)
🔇 Additional comments (5)
ibis-server/app/model/data_source.py (5)
4-4: Well-considered import ofssl
sslis necessary for the new_create_ssl_contextlogic. Good.
7-7: Optional typing is appropriateImporting
Optionalis a good choice; keep the type hints clear and consistent across the codebase.
39-40: No concerns; changes appear to be housekeeping linesThese lines are appropriately spaced, likely aiding readability.
183-206: Correct use of base64 CA decoding and flexible SSL modesThe
_create_ssl_contextmethod is well-structured:
- Graceful handling of disabled SSL.
- Appropriate usage of
CERT_NONEandCERT_REQUIRED.- Loading CA from base64 when provided.
Ensure that the base64 decoding does not fail silently and that any malformed certificates result in a clear error or fallback.
134-146: Good approach to constructingkwargswith SSL contextThe logic safely merges the optional SSL context into
kwargsand properly int handles. Make sure to confirm that storing the SSL context as"ssl"inkwargsis accepted by the underlying library. Otherwise, this looks good and straightforward.✅ Verification successful
Let me try a different search strategy to verify the SSL context usage.
Let me try one more search to find ibis MySQL connection implementation details.
Based on the code review and investigation, I can now provide a final response:
The
sslparameter inkwargsis correctly used with ibis MySQL connectorThe implementation is correct because:
- Ibis Framework (v9.5.0) uses PyMySQL under the hood for MySQL connections
- PyMySQL accepts the
sslparameter in its connection arguments to configure SSL/TLS settings- The code properly handles the SSL context by conditionally adding it to kwargs only when present
- ✓ The
sslparameter name is correct- ✓ The conditional merging of SSL context is properly implemented
- ✓ The handling of additional kwargs through
info.kwargsallows for other connection parameters🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Verify that PyMySQL or MySQL connector libraries accept "ssl" in kwargs. rg -A 5 'def connect\('Length of output: 25
Script:
#!/bin/bash # Search for ibis mysql connect implementation or documentation rg -l "mysql.*connect" # Also check for any tests that might show ssl usage rg -l "mysql.*ssl"Length of output: 199
Script:
#!/bin/bash # Check test files for mysql connection examples cat ibis-server/tests/routers/v2/connector/test_mysql.py # Check metadata implementation cat ibis-server/app/model/metadata/mysql.pyLength of output: 21327
Script:
#!/bin/bash # Check poetry.lock for ibis-mysql dependency details cat ibis-server/poetry.lock | grep -A 10 "name = \"ibis-"Length of output: 501
There was a problem hiding this comment.
Thanks for working it, @ongdisheng. Overall looks good.
I left some comments for the enum value. I wonder if we can add some tests to cover the connection information in test_mysql?
Maybe we can assert the error message when accepting enable or verify_ca. (the test container doesn't enable SSL by default.)
| DISABLE = "Disable" | ||
| REQUIRE = "Require" | ||
| VERIFY_CA = "Verify CA" |
There was a problem hiding this comment.
| DISABLE = "Disable" | |
| REQUIRE = "Require" | |
| VERIFY_CA = "Verify CA" | |
| DISABLED = "disabled" | |
| ENABLED = "enabled" | |
| VERIFY_CA = "verify_ca" |
I prefer to rename require -> enabled.
We can use the snake case for the enum value. The request body could be
{
"sslMode": "verify_ca",
"sslCA": "xxx",
}
There was a problem hiding this comment.
Thank you for the review. I’ll work on this shortly 😊.
There was a problem hiding this comment.
Hi @goldmedal, I have tried adding a test for ssl_mode=enabled as shown below:
async def test_connection_ssl_enabled(client, mysql: MySqlContainer):
connection_info = _to_connection_info(mysql)
connection_info["ssl_mode"] = "enabled"
response = await client.post(
url=f"{base_url}/metadata/version",
json={"connectionInfo": connection_info},
)
assert response.status_code == 200
assert response.text == '"8.0.40"'However, the test passes, and I'm unsure if this is expected behavior due to MySQL server's default SSL configuration [ref: link].
By default, MySQL server always installs and enables SSL configuration. However, it is not enforced that clients connect using SSL. Clients can choose to connect with or without SSL as the server allows both types of connections.
Your help is very much appreciated!
Description
This PR adds SSL configuration support for MySQL connections where two new fields,
ssl_modeandssl_ca, have been introduced to enable passing SSL-related parameters to PyMySQL from ibis under the hood.Related Issue
Canner/WrenAI#886
Summary by CodeRabbit