Cloudflare Developers•3y ago

TLS, then WebSocket. Every time.

MMatt Silverlock TLS, then WebSocket. Every time.

Isaac McFadyen•10/12/23, 8:42 PM

Do they not have edge nodes handling TLS closer to the Worker?

IIsaac McFadyen Do they not have edge nodes handling TLS closer to the Worker?

Matt SilverlockOP•10/12/23, 8:42 PM

No.

Isaac McFadyen•10/12/23, 8:42 PM

I know Prisma has many edge nodes despite having the DB be central.

Isaac McFadyen•10/12/23, 8:43 PM

Oh, interesting. OK then.

IIsaac McFadyen I know Prisma has many edge nodes despite having the DB be central.

Hello, I’m Allie!•10/13/23, 5:13 AM

Isn’t Prisma Edge CF already?

Colin•10/15/23, 11:23 PM

Hi! I'm getting a

Connection terminated unexpectedly

Connection terminated unexpectedly

error thrown while trying to query my Postgres DB w/ Hyperdrive. Using almost exactly the example code here:

const client = new Client({
  connectionString: context.env.DB_HYPERDRIVE.connectionString,
});

// Connect to our database
console.log("START CONNECT");
await client.connect();
console.log("END CONNECT");

// Test query
console.log("START QUERY");
const result = await client.query({
    text: "SELECT * FROM pg_tables",
});
console.log("END QUERY");

// Returns result rows as JSON
return context.json({ result: result });

const client = new Client({
  connectionString: context.env.DB_HYPERDRIVE.connectionString,
});

// Connect to our database
console.log("START CONNECT");
await client.connect();
console.log("END CONNECT");

// Test query
console.log("START QUERY");
const result = await client.query({
    text: "SELECT * FROM pg_tables",
});
console.log("END QUERY");

// Returns result rows as JSON
return context.json({ result: result });

client.connect()

client.connect()

is finishing fine, but

client.query()

client.query()

is throwing

Connection terminated unexpectedly

Connection terminated unexpectedly

. I'm setting

node_compat = true

node_compat = true

in my

wrangler.toml

wrangler.toml

as well. Any ideas?

Colin•10/16/23, 1:54 AM

^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. We had our certificate set to

rds-ca-rsa2048-g1

rds-ca-rsa2048-g1

, the issue fixed itself when changing back to the default

rds-ca-2019

rds-ca-2019

. Definitely a confusing error message (not sure if this is a

pg

pg

issue, or a Workers issue via the

connect

connect

call), but hopefully this can help someone else!

CColin ^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. W...

Matt SilverlockOP•10/16/23, 10:12 AM

This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.

CColin ^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. W...

Matt SilverlockOP•10/16/23, 2:02 PM

For clarity, after re-reading your message: this is via Hyperdrive, right? Not just

connect()

connect()

directly?

MMatt Silverlock This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS C...

Colin•10/16/23, 2:05 PM

I'm a little bit confused here. The docs do call out custom CA certs, but the default mode in

pg

pg

(not sure what Hyperdrive->AWS is using) doesn't verify certificates

MMatt Silverlock For clarity, after re-reading your message: this is via Hyperdrive, right? Not j...

Colin•10/16/23, 2:05 PM

Correct.

connect()

connect()

directly w/

sslmode=REQUIRE

sslmode=REQUIRE

doesn't verify the certs, so it works as expected

Colin•10/16/23, 2:05 PM

It's only when connecting via Hyperdrive, which I'm assuming is verify-ca or verify-full

CColin It's only when connecting via Hyperdrive, which I'm assuming is verify-ca or ver...

Matt SilverlockOP•10/16/23, 2:06 PM

No, per the docs: Hyperdrive does not support those modes. We only support

require

require

(and prefer, but we ultimately require TLS).

Colin•10/16/23, 2:06 PM

and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.

I'm a little unsure what you meant by this bit then

Colin•10/16/23, 2:06 PM

If we're only using

require

require

wouldn't cert validation not take place?

CColin If we're only using `require` wouldn't cert validation not take place?

Matt SilverlockOP•10/16/23, 2:07 PM

Let's step back a second.

You are using Hyperdrive and having issues when using the
```
rds-ca-rsa2048-g1
```
```
rds-ca-rsa2048-g1
```
CA, correct?
When using the raw TCP
```
connect()
```
```
connect()
```
API without Hyperdrive you have no issues, correct?

Colin•10/16/23, 2:08 PM

correct

CColin correct

Matt SilverlockOP•10/16/23, 2:10 PM

They both share the same egress/TLS path, so this is odd. We shouldn't be validating the cert.

Matt SilverlockOP•10/16/23, 2:10 PM

(We'll look into it)

Colin•10/16/23, 2:11 PM

I should add there’s a little bit of fuzziness - I couldn’t immediately see results when changing the database CA, it took <=10m

CColin I should add there’s a little bit of fuzziness - I couldn’t _immediately_ see re...

Matt SilverlockOP•10/16/23, 2:11 PM

AWS says that changing the CA is not an immediate action

Colin•10/16/23, 2:12 PM

I interpreted that in the context of it waiting for the next maintenance window (which we forced immediately), not that there’d be propagation delay

Colin•10/16/23, 2:12 PM

But that is definitely possible

Colin•10/16/23, 2:12 PM

and I’m only assuming the underlying issue is cert validation - the error message was very vague

Aalexrobinson @Colin if you can DM me your account ID (or hyperdrive ID), I'll try tracking do...

Colin•10/16/23, 2:20 PM

Sure thing, I added you

kian•10/16/23, 4:36 PM

On normal Workers it requires

node_compat

node_compat

which is a set of polyfills (https://github.com/ionic-team/rollup-plugin-node-polyfills/) so I'm not sure if you'd be able to get that working alongside next-on-pages

kian•10/16/23, 4:38 PM

Different thing.

kian•10/16/23, 4:39 PM

The Pages team don't plan to add

node_compat

node_compat

to Pages, maybe you can ask the next-on-pages team to add it to that framework.

Colin•10/16/23, 5:52 PM

node-postgres

node-postgres

other drivers requiring
```
node_compat
```
```
node_compat
```
is a result of the individual drivers, not Hyperdrive, correct?

kian•10/16/23, 5:52 PM

Yeah

kian•10/16/23, 5:53 PM

Hyperdrive as far as your Worker is concerned is just a connection string

Colin•10/16/23, 5:53 PM

I wonder what part of those libs require it + if we'll ever get a "WinterCG-native" PG driver, since I don't think(?)

connect()

connect()

itself requires it

kian•10/16/23, 5:54 PM

I don't think it actually requires them, but they're not conditionally required - esbuild sees they're there, and can't tell that they won't be used at runtime with Workers.

Colin•10/16/23, 5:54 PM

I thought that's what separate workerd entrypoint solves

Colin•10/16/23, 5:55 PM

^^ or could solve, again I have zero knowledge of these drivers

kian•10/16/23, 5:56 PM

node-postgres

node-postgres

doesn't have those, so possibly, but I have no idea

Colin•10/16/23, 5:59 PM

yeah me neither, and it doesn't impact our Worker luckily, but I've seen a lot of people having the

node_compat

node_compat

nodejs_compat

nodejs_compat

dilemma in this channel so far

Aliez•10/17/23, 9:36 AM

How to use hyperdrive in pages functions?

James•10/17/23, 12:51 PM

Unfortunately Pages Functions doesn’t support node_compat bundling, nor the hyperdrive binding, so I’m not aware of a simple way to get hyperdrive working with Pages, sorry

James•10/18/23, 4:03 AM

[ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdrive/configs) failed.

not_entitled [code: 10000]

i got this error while using wrangler hyperdrive create name --connection-string="connection_string"

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

James•10/18/23, 4:26 AM

anyone

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

Sam•10/18/23, 9:03 AM

Are you on the paid workers plan?

SSam Are you on the paid workers plan?

James•10/18/23, 9:17 AM

Yes

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

Matt SilverlockOP•10/18/23, 12:30 PM

Can you share your account ID please? (it's safe to share publicly)

MMatt Silverlock Can you share your account ID please? (it's safe to share publicly)

James•10/18/23, 12:32 PM

1d1c3f97856c67d63a1d69697bcb3b0d

const client = new Client({ connectionString: context.env.DB_HYPERDRIVE.connectionString, }); // Connect to our database console.log("START CONNECT"); await client.connect(); console.log("END CONNECT"); // Test query console.log("START QUERY"); const result = await client.query({ text: "SELECT * FROM pg_tables", }); console.log("END QUERY"); // Returns result rows as JSON return context.json({ result: result });

TLS, then WebSocket. Every time.

Similar Threads

Similar Threads

Similar Threads