PaaS
In this article:
PaaS#
PaaS services allow you to quickly deploy a complex software system, such as DBMS, in the cloud. Infrastructure provisioning and software setup are automatic so that you get a ready-to-use service in a few minutes.
В настоящее время K2 Cloud поддерживает PaaS-сервисы для развёртывания баз данных, кеширования, поиска и аналитики, брокера сообщений, мониторинга и логирования. Список поддерживаемых сервисов регулярно пополняется. Оплата взимается за использование вычислительных ресурсов.
To find a service, go to the Service store subsection. All platform services are shown on the same page and divided into categories. To simplify the search, all services of the same category are presented in a separate tab. Select the desired service and run it using the creation wizard.
Previously created services are available in the Running services subsection. You can view their details, as well as create additional services or delete them.
You can enable backup for the database service. Information about database services, for which backups are available, is displayed in the Service backups subsection.
Using PaaS platform services in the cloud allows you to focus on business-critical tasks and not waste time on infrastructure-related issues.
TLS#
The TLS protocol allows you to encrypt PaaS service traffic so that data cannot be read or tampered with while being transmitted over the network. Service nodes present a certificate issued by the K2 Cloud certificate authority to the client, and the client verifies this certificate against the CA certificate of this certificate authority.
TLS is supported by the MySQL and PostgreSQL and Apache Kafka PaaS services. The list of services with TLS support is regularly expanded.
Enabling TLS#
TLS is enabled with the Enable TLS option in the service creation wizard, at the step where the main service parameters are set. TLS can also be enabled or disabled after the service is created.
The Enable TLS option enables encryption of client connections to the DBMS. Clients can still connect without TLS. To reject such connections, also enable the Require TLS option.
The Enable TLS option enables encryption of client connections to the DBMS. Clients can still connect without TLS. To reject such connections, also enable the Require TLS option. Local connections via UNIX sockets work without TLS regardless of the parameter value.
The Enable TLS option enables encryption of both client and inter-broker traffic: connections between client applications and brokers and connections between cluster nodes. Inter-broker traffic is configured automatically during service deployment. Once the option is enabled, connections without TLS are not accepted, so Kafka has no separate Require TLS option.
On the client side, install the CA certificate and configure certificate verification when connecting (see Connecting with certificate verification).
You can also enable TLS when creating a service using the CreateService API method (see the tls parameter in the service creation parameters for MySQL, PostgreSQL, and Kafka). For MySQL and PostgreSQL, the tlsEnforce parameter has to be set to reject connections without TLS.
CA certificate#
For the client to verify the certificate presented by a PaaS service node, the CA certificate of the K2 Cloud certificate authority must be installed on the client side.
Below is the CA certificate for the ru-msk region. Copy it to the paas-ca.crt file: you will need it when installing the certificate and configuring the connection.
-----BEGIN CERTIFICATE-----
MIIDGzCCAgOgAwIBAgIQNLqx+b3R48si11ClKvDnlzANBgkqhkiG9w0BAQsFADAX
MRUwEwYDVQQDDAxwYWFzLXJvb3QtY2EwHhcNMjYxMTA1MTQwNjA0WhcNMzYxMTAz
MTQwNjA0WjAXMRUwEwYDVQQDDAxwYWFzLXJvb3QtY2EwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDNsyQoeZ+IdlQEjWuVVFtoJ/0JjSqNVM/3xwyJYQQc
i7CZRzoPX5gSKL0PWPtCeQ/zyWeClumORP8sdDIy7dQff/ostTUK9B3fnhq9VVpX
R4a+SpYm/9xZrNRQ8lkJFVNaTTbxNvHD3MCZGDrbS00YORH3lk0Dh05YNz8ZfO2J
Fmh/di1ZrIBeuKm1a3f1D59kYMXCIGCP5zwDcd9BAqpqzM48Z1hmdH6jDPXNIlCq
x/MYJZ+zLkN3zE+54fcFg4Fo1e40cGD+o7RjoyYjQGnep3jEerjeGoFCh51lDkSi
gpvvkDENKxQFWIQ/+RQbpPKEYAyV9YI2BG9lJ5cxFW2rAgMBAAGjYzBhMA8GA1Ud
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQHQPgEZGx1j8h3
Oi03ajnO9BX7UzAfBgNVHSMEGDAWgBQHQPgEZGx1j8h3Oi03ajnO9BX7UzANBgkq
hkiG9w0BAQsFAAOCAQEAV3zhO1Z3HHpSyNRMHnUXQqZjR2RpRhCzQmnK4HNQHdpL
c9QwIqoNuv/zcB3lh1Z3fvfOQis0zDBqKbxEqibfDJJ8cazFXtpSevcbcziHUqY+
YfY1KDuPrmzc92di3UgsQKq51pRcrokmZqYWaYoEQ80LK3skyR+c3qDuDbAnwL8O
oigCKcG/x9iE/sE3s+Ld9Dgx0MaHzSXLXBE6FOoVf7r33lT7VIR60conL4/+4Cr0
0BYoG0B3lqxg0RtndpaYxVx4Zdw481GtFqsn3Oy1p/Nd7NXc1Ty9P0E6noTLb6+Q
auZfy9TN1PWKvVlX9TV2s9upqSZcbCjTGSp2I9puTQ==
-----END CERTIFICATE-----
If you need a certificate for the ru-spb region, contact technical support via the portal or by email at support@k2.cloud.
Install the certificate#
For system utilities and applications to trust PaaS service node certificates, add the CA certificate to the trusted root certificate store of the operating system. For applications that use their own certificate store, it is enough to specify the path to the certificate file or to the application store instead (see Connecting with certificate verification).
In Debian- and Ubuntu-based distributions:
sudo cp paas-ca.crt /usr/local/share/ca-certificates/paas-ca.crt
sudo update-ca-certificates
In RHEL- and CentOS-based distributions:
sudo cp paas-ca.crt /etc/pki/ca-trust/source/anchors/paas-ca.crt
sudo update-ca-trust extract
Run PowerShell as administrator:
Import-Certificate -FilePath .\paas-ca.crt -CertStoreLocation Cert:\LocalMachine\Root
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain paas-ca.crt
Connecting with certificate verification#
Example for the mysql client included in MySQL and Percona Server:
mysql --host=<service-address> --port=<port> --user=<user> --password --ssl-mode=VERIFY_CA --ssl-ca=paas-ca.crt
In the VERIFY_CA mode, the client verifies that the server certificate was issued by the K2 Cloud certificate authority. In other clients and drivers, specify the path to the paas-ca.crt file in the CA certificate parameter and enable server certificate verification.
psql "host=<service-address> port=<port> dbname=<database> user=<user> sslmode=verify-ca sslrootcert=paas-ca.crt"
In the verify-ca mode, the client verifies that the server certificate was issued by the K2 Cloud certificate authority. The same sslmode and sslrootcert parameters are supported by libpq-based drivers and by the PostgreSQL JDBC driver.
Java clients, including the standard Kafka utilities, use a truststore in JKS format. Add the CA certificate to it:
keytool -importcert -alias paas-ca -file paas-ca.crt -keystore paas-truststore.jks -storepass <truststore-password> -noprompt
Specify the truststore in the client settings, for example, in the client.properties file:
security.protocol=SSL
ssl.truststore.location=/path/to/paas-truststore.jks
ssl.truststore.password=<truststore-password>
The settings file is passed to the standard Kafka utilities in the --command-config, --producer.config, or --consumer.config parameters:
kafka-topics.sh --bootstrap-server <broker-address>:<port> --command-config client.properties --list
Clients based on the librdkafka library (C/C++, Python, Go, .NET) use the certificate file itself:
security.protocol=SSL
ssl.ca.location=/path/to/paas-ca.crt
Note
Specify the addresses of all cluster brokers: this allows the client to automatically switch to a healthy node (for details, see the usage recommendations).