Setting this system variable to a non-zero value on a primary replica in a
sql-server cluster will cause dolt to block a SQL client performing a commit
until that client's commit is fully replicated to the replicas.
If there is a timeout, currently a warning is logged in the logs.
A remotesapi server running on a cluster replica publishes a JWKS.
Every outbound GRPC call the cluster replica makes includes a JWT signed with a
private key.
remotesapi servers running on cluster replicas require and validate incoming
JWTs for cluster traffic. The set of valid signing keys is taken from the
JWKSes which are published at /.well-known/jwks.json on the standby replica
hosts.
It is possible to configure tls_ca on cluster remotesapi to configure the set
of trusted roots for outbound TLS connections. Because the JWKSes are served
over the same connection, and becuase signed JWTs are not replay resistent, TLS
is recommended for all deployment topologies.
For now, this is server-side TLS, not mTLS.
If a tls_ca is configured, the certificates in that file are PEM encoded. They
are the only trusted roots for server certificate verification on both gRPC and
HTTP connections. If tls_ca is set, no server name verification is done for
now.
Aaron Son