Question: how is this the case with Websockets? Is there still a handshake procedure that requires e
Question: how is this the case with Websockets? Is there still a handshake procedure that requires extra round-trips?
MTLS, then WebSocket. Every time.
IDo they not have edge nodes handling TLS closer to the Worker?
MNo.
II know Prisma has many edge nodes despite having the DB be central.
IOh, interesting. OK then.
HIsn’t Prisma Edge CF already?
CHi! I'm getting a
Connection terminated unexpectedlyclient.connect()client.query()Connection terminated unexpectedlynode_compat = truewrangler.toml^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. We had our certificate set to
rds-ca-rsa2048-g1rds-ca-2019pgconnect
MThis is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.
MFor clarity, after re-reading your message: this is via Hyperdrive, right? Not just
connect()I'm a little bit confused here. The docs do call out custom CA certs, but the default mode in
pg
CCorrect.
connect()sslmode=REQUIREIt's only when connecting via Hyperdrive, which I'm assuming is verify-ca or verify-full
MNo, per the docs: Hyperdrive does not support those modes. We only support
requireand the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.I'm a little unsure what you meant by this bit then
CIf we're only using
requireLet's step back a second.
- You are using Hyperdrive and having issues when using the
CA, correct?rds-ca-rsa2048-g1 - When using the raw TCP
API without Hyperdrive you have no issues, correct?connect()
Ccorrect
MThey both share the same egress/TLS path, so this is odd. We shouldn't be validating the cert.
M(We'll look into it)
CI should add there’s a little bit of fuzziness - I couldn’t immediately see results when changing the database CA, it took <=10m
MAWS says that changing the CA is not an immediate action
CI interpreted that in the context of it waiting for the next maintenance window (which we forced immediately), not that there’d be propagation delay
CBut that is definitely possible
Cand I’m only assuming the underlying issue is cert validation - the error message was very vague
CSure thing, I added you
KOn normal Workers it requires
node_compatDifferent thing.
KThe Pages team don't plan to add
node_compatnode-postgres- other drivers requiring
is a result of the individual drivers, not Hyperdrive, correct?node_compat
KYeah
KHyperdrive as far as your Worker is concerned is just a connection string
CI wonder what part of those libs require it + if we'll ever get a "WinterCG-native" PG driver, since I don't think(?)
connect()I don't think it actually requires them, but they're not conditionally required - esbuild sees they're there, and can't tell that they won't be used at runtime with Workers.
CI thought that's what separate workerd entrypoint solves
C^^ or could solve, again I have zero knowledge of these drivers
Knode-postgresyeah me neither, and it doesn't impact our Worker luckily, but I've seen a lot of people having the
node_compatnodejs_compat
AHow to use hyperdrive in pages functions?
JUnfortunately Pages Functions doesn’t support node_compat bundling, nor the hyperdrive binding, so I’m not aware of a simple way to get hyperdrive working with Pages, sorry
J[ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdrive/configs) failed.
not_entitled [code: 10000]
i got this error while using wrangler hyperdrive create name --connection-string="connection_string"
not_entitled [code: 10000]
i got this error while using wrangler hyperdrive create name --connection-string="connection_string"
Janyone
SAre you on the paid workers plan?
JYes
MCan you share your account ID please? (it's safe to share publicly)
