Repository navigation
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
The events map of the jsoncs3 share manager did not have the enabletls key. Thus reva did not add the TLS options. The client did not use the root CA certificate. The connection to a NATS server with a private CA failed with "x509: certificate signed by unknown authority". The map now gets cfg.Events.EnableTLS. A new unit test checks all the NATS keys of the jsoncs3 events map and of the events middleware. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Roman Perekhod <2403905@gmail.com> (cherry picked from commit 4469b6d)
…e events The sciencemesh and the ocmcore events maps did not have the enabletls key. reva reads this key in both services. Thus these connections did not use TLS options and did not use the root CA certificate. Both maps now get cfg.Events.EnableTLS. A new unit test checks all the NATS keys of both events maps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Roman Perekhod <2403905@gmail.com> (cherry picked from commit 3b3eb5f)
2403905
force-pushed
the
fix/OCISDEV-1687-jsoncs3-nats-tls-stable-9.0
branch
from
November 12, 2026 13:03
b93c22f to
22c7745
Compare
This was referenced Nov 12, 2026
2403905
changed the title
jvillafanez
approved these changes
Nov 13, 2026
2403905
enabled auto-merge (squash)
November 13, 2026 18:30
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The sharing service did not give
OCIS_EVENTS_ENABLE_TLSto the jsoncs3 share manager. The ocm service did not give it to the sciencemesh and the ocmcore event connections. reva reads theenabletlskey in all three places. Without the key, reva did not add the TLS options. Thus the client did not useOCIS_EVENTS_TLS_ROOT_CA_CERTIFICATE.With a NATS server that uses TLS with a private CA, these connections failed with
x509: certificate signed by unknown authority. The services tried again for up to 15 minutes. The health check uses the full config, so the pods stayed Ready.enabletlsto the jsoncs3 events map inservices/sharing/pkg/revaconfig/config.go.enabletlsto the sciencemesh and the ocmcore events maps inservices/ocm/pkg/revaconfig/config.go.The fix is in oCIS only. reva needs no change.
This is the backport of #13443 to stable-9.0. The backport to stable-8.0 is #13442.
🤖 Generated with Claude Code