Intracluster communication joining key (cluster key)

[l-monninger]

Other than network controls and user-level permissions, is there a way to restrict cluster joining? In some other cluster services (e.g., Redis, IPFS, etc.), for example, there will be a cluster key/secret/password.

[otoolep]

Do you mean is there a way to only allow authorized nodes to join a cluster? Yes, there is full control over that via username and passwords, but not via SSL certs though.

https://github.com/rqlite/rqlite/blob/master/DOC/SECURITY.md

https://github.com/rqlite/rqlite/blob/master/DOC/SECURITY.md#user-level-permissions

[l-monninger]

Oh, yep that seems to be what I need. I guess I skimmed this too fast:

user can join a cluster. In practice only a node joins a cluster, so it's the joining node that must supply the credentials

Out of curiosity, is this ultimately implemented on the database layer just like other DB permissions? Or, is there something in between?

[otoolep]

Permission checking is implemented by rqlite, before anything hits the SQLite layer. Does that answer your question?

[l-monninger]

Oh, interesting. Thanks!

Sort of. I was more interested in whether join permissions specifically differ from other rqlite user-level permission implementations. But, I guess that's coming from some faulty assumptions.