Skip to content

security: add docs for reloading certs in TLS between TiDB components doc #2930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 11, 2025
Merged

security: add docs for reloading certs in TLS between TiDB components doc #2930

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d67bc91
add docs for reloading certs
YangKeao Sep 19, 2025
cdf5940
Apply suggestions from code review
hfxsd Sep 24, 2025
6afad85
Apply suggestions from code review
hfxsd Oct 11, 2025
818f663
Apply suggestions from code review
hfxsd Oct 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions en/enable-tls-between-components.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1747,3 +1747,11 @@ This section describes how to enable TLS encrypted communication for an existing
5. If you previously scaled down the PD nodes, scale them back up to the original number.

6. Wait for all Pods in the TiDB cluster to restart.

## Reload certificates

If you used `cfssl` to generate the cert and key files manually, you'll need to update the `Secret` manually.

If you used `cert-manager` to generate the cert and key files, it'll update the `Secret` automatically if any issuance happened.

TiDB, PD, TiKV, TiFlash, TiCDC, TiProxy, and all kinds of clients reread the current certificates and key files each time a new connection is created, without restarting the TiDB cluster. Once the `Secret` is updated, the certs and keys will be reloaded automatically.
8 changes: 8 additions & 0 deletions zh/enable-tls-between-components.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1733,3 +1733,11 @@ aliases: ['/docs-cn/tidb-in-kubernetes/dev/enable-tls-between-components/']
5. 如果之前进行了 PD 节点缩容，请将其扩容为原有数量。

6. 等待 TiDB 集群中的所有 Pod 完成重启。

## 证书重新加载

如果通过 `cfssl` 的方式创建证书，你将需要手动更新 `Secret`。

如果通过 `cert-manager` 的方式创建证书，`cert-manager` 将在重新颁发证书的时候自动更新 `Secret`。

TiDB、PD、TiKV、TiFlash、TiCDC 和各种 client 在每次新建相互通讯的连接时都会重新读取当前的证书和密钥文件内容，实现证书和密钥的重新加载，无需重启 TiDB 集群。所以在 `Secret` 更新后，证书将会自动更新。