password of default user is not propagated to shards about clickhouse-operator HOT 6 CLOSED

Hello, everyone. There is little workaround for this problem - you can use networks access list to avoid password.
For example:

    users:
      default/networks/host_regexp:
      - ^chi-cluster-cluster-\d-\d.*$
      - ^chi-cluster-cluster-\d-\d-\d\..*$
      default/networks/ip:
      - "::1"
      - "127.0.0.1"
      default/profile: default
      default/quota: default
      default/connect_timeout_with_failover_ms: 1000```

from clickhouse-operator.

Good catch, @ralfbecher.

The common practice is to keep default user with no password BUT limited to cluster nodes only and only used for inter-cluster communication. This is how operator deploys default configuration.

I agree that operator should automatically propagate password to remote_servers, but it creates a extra security vulnerability, since password in remote_servers can not be masked/hashed, unlike user definition.

Probably we should forbid changing default user password and network settings at all.

from clickhouse-operator.

Then you could add the functionality of hashed password to remote_servers...

from clickhouse-operator.

@ralfbecher , unfortunately, ClickHouse needs a real password in order to connect to other servers, hashed password can not work. So either we tolerate plain passwords in remote_servers, or do not need any passwords here at all and rely on network security.

from clickhouse-operator.

ClickHouse/ClickHouse#13156 added secure inter-cluster query execution to v20.10.3.30+.
For each cluster in the metrika.xml, add an non-empty secret tag. This indicates clickhouse to use current query user to do remote queries.

    <remote_servers>
        <abc>
            <secret>foo</secret>
            <shard>
                <internal_replication>true</internal_replication>
                <replica>
                    <host>192.168.101.106</host>
                    <port>9000</port>
                </replica>
                <replica>
                    <host>192.168.101.108</host>
                    <port>9000</port>
                </replica>
            </shard>
            <shard>
                <internal_replication>true</internal_replication>
                <replica>
                    <host>192.168.101.110</host>
                    <port>9000</port>
                </replica>
                <replica>
                    <host>192.168.102.114</host>
                    <port>9000</port>
                </replica>
            </shard>
        </abc>
    </remote_servers>

from clickhouse-operator.

https://github.com/Altinity/clickhouse-operator/blob/master/docs/security_hardening.md

cc @ralfbecher

from clickhouse-operator.