^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. We had our certificat

^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. We had our certificate set to

rds-ca-rsa2048-g1

rds-ca-rsa2048-g1

rds-ca-rsa2048-g1

rds-ca-rsa2048-g1, the issue fixed itself when changing back to the default

rds-ca-2019

rds-ca-2019

rds-ca-2019

rds-ca-2019 . Definitely a confusing error message (not sure if this is a

pg

pg

issue, or a Workers issue via the

connect

connect

connect

connect call), but hopefully this can help someone else!

CColin ^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. W...

Matt Silverlock•10/16/23, 10:12 AM

This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.

CColin ^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. W...

Matt Silverlock•10/16/23, 2:02 PM

For clarity, after re-reading your message: this is via Hyperdrive, right? Not just

connect()

connect()

directly?

MMatt Silverlock This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS C...

ColinOP•10/16/23, 2:05 PM

I'm a little bit confused here. The docs do call out custom CA certs, but the default mode in

pg

pg

(not sure what Hyperdrive->AWS is using) doesn't verify certificates

MMatt Silverlock For clarity, after re-reading your message: this is via Hyperdrive, right? Not j...

ColinOP•10/16/23, 2:05 PM

Correct.

connect()

connect()

directly w/ sslmode=REQUIREsslmode=REQUIRE doesn't verify the certs, so it works as expected

ColinOP•10/16/23, 2:05 PM

It's only when connecting via Hyperdrive, which I'm assuming is verify-ca or verify-full

CColin It's only when connecting via Hyperdrive, which I'm assuming is verify-ca or ver...

Matt Silverlock•10/16/23, 2:06 PM

No, per the docs: Hyperdrive does not support those modes. We only support

require

require

(and prefer, but we ultimately require TLS).

ColinOP•10/16/23, 2:06 PM

and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.

I'm a little unsure what you meant by this bit then

ColinOP•10/16/23, 2:06 PM

If we're only using

require

require

wouldn't cert validation not take place?

CColin If we're only using `require` wouldn't cert validation not take place?

Matt Silverlock•10/16/23, 2:07 PM

Let's step back a second.

You are using Hyperdrive and having issues when using the
```
rds-ca-rsa2048-g1
```
```
rds-ca-rsa2048-g1
```
CA, correct?
When using the raw TCP
```
connect()
```
```
connect()
```
API without Hyperdrive you have no issues, correct?

ColinOP•10/16/23, 2:08 PM

correct

CColin correct

Matt Silverlock•10/16/23, 2:10 PM

They both share the same egress/TLS path, so this is odd. We shouldn't be validating the cert.

Matt Silverlock•10/16/23, 2:10 PM

(We'll look into it)

ColinOP•10/16/23, 2:11 PM

I should add there’s a little bit of fuzziness - I couldn’t immediately see results when changing the database CA, it took <=10m

CColin I should add there’s a little bit of fuzziness - I couldn’t _immediately_ see re...

Matt Silverlock•10/16/23, 2:11 PM

AWS says that changing the CA is not an immediate action

ColinOP•10/16/23, 2:12 PM

I interpreted that in the context of it waiting for the next maintenance window (which we forced immediately), not that there’d be propagation delay

ColinOP•10/16/23, 2:12 PM

But that is definitely possible

ColinOP•10/16/23, 2:12 PM

and I’m only assuming the underlying issue is cert validation - the error message was very vague

Aalexrobinson @Colin if you can DM me your account ID (or hyperdrive ID), I'll try tracking do...

ColinOP•10/16/23, 2:20 PM

Sure thing, I added you

kian•10/16/23, 4:36 PM

On normal Workers it requires

node_compat

node_compat

which is a set of polyfills (https://github.com/ionic-team/rollup-plugin-node-polyfills/) so I'm not sure if you'd be able to get that working alongside next-on-pages

kian•10/16/23, 4:38 PM

Different thing.

kian•10/16/23, 4:39 PM

The Pages team don't plan to add

node_compat

node_compat

to Pages, maybe you can ask the next-on-pages team to add it to that framework.

ColinOP•10/16/23, 5:52 PM

node-postgres

node-postgres

other drivers requiring
```
node_compat
```
```
node_compat
```
is a result of the individual drivers, not Hyperdrive, correct?

kian•10/16/23, 5:52 PM

Yeah

kian•10/16/23, 5:53 PM

Hyperdrive as far as your Worker is concerned is just a connection string

ColinOP•10/16/23, 5:53 PM

I wonder what part of those libs require it + if we'll ever get a "WinterCG-native" PG driver, since I don't think(?)

connect()

connect()

itself requires it

kian•10/16/23, 5:54 PM

I don't think it actually requires them, but they're not conditionally required - esbuild sees they're there, and can't tell that they won't be used at runtime with Workers.

ColinOP•10/16/23, 5:54 PM

I thought that's what separate workerd entrypoint solves

ColinOP•10/16/23, 5:55 PM

^^ or could solve, again I have zero knowledge of these drivers

kian•10/16/23, 5:56 PM

node-postgres

node-postgres

doesn't have those, so possibly, but I have no idea

ColinOP•10/16/23, 5:59 PM

yeah me neither, and it doesn't impact our Worker luckily, but I've seen a lot of people having the

node_compat

node_compat

nodejs_compat

nodejs_compat

dilemma in this channel so far

Aliez•10/17/23, 9:36 AM

How to use hyperdrive in pages functions?

James•10/17/23, 12:51 PM

Unfortunately Pages Functions doesn’t support node_compat bundling, nor the hyperdrive binding, so I’m not aware of a simple way to get hyperdrive working with Pages, sorry

James•10/18/23, 4:03 AM

[ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdrive/configs) failed.

not_entitled [code: 10000]

i got this error while using wrangler hyperdrive create name --connection-string="connection_string"

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

James•10/18/23, 4:26 AM

anyone

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

Sam•10/18/23, 9:03 AM

Are you on the paid workers plan?

SSam Are you on the paid workers plan?

James•10/18/23, 9:17 AM

Yes

JJames [ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdr...

Matt Silverlock•10/18/23, 12:30 PM

Can you share your account ID please? (it's safe to share publicly)

MMatt Silverlock Can you share your account ID please? (it's safe to share publicly)

James•10/18/23, 12:32 PM

1d1c3f97856c67d63a1d69697bcb3b0d

JJames 1d1c3f97856c67d63a1d69697bcb3b0d

Matt Silverlock•10/18/23, 12:34 PM

You do not have a paid Workers plan.

Matt Silverlock•10/18/23, 12:34 PM

Hyperdrive (currently) requires a paid Workers plan per https://developers.cloudflare.com/hyperdrive/get-started/#prerequisites / https://developers.cloudflare.com/workers/platform/pricing/#workers

MMatt Silverlock You do not have a paid Workers plan.

James•10/18/23, 12:35 PM

this is the test account where we test the things before the production

James•10/18/23, 12:35 PM

so i think we need to login with that account through wrangler

JJames so i think we need to login with that account through wrangler

Matt Silverlock•10/18/23, 12:36 PM

Yep. You can use

CLOUDFLARE_ACCOUNT_ID

CLOUDFLARE_ACCOUNT_ID

as an env var too: https://developers.cloudflare.com/workers/wrangler/configuration/#inheritable-keys

Configuration - Wrangler · Cloudflare Workers docs

Wrangler optionally uses a wrangler.toml configuration file to customize the development and deploying setup for a Worker.

MMatt Silverlock Yep. You can use `CLOUDFLARE_ACCOUNT_ID` as an env var too: https://developers.c...

James•10/18/23, 12:37 PM

thx it's works

Huxwell | Reown•10/20/23, 11:18 AM

Hey team, I'm integrating Hyperdrive on an existing project and it works great.
However when I run the tests using

unstable_dev

unstable_dev

my tests are failing with the following error.
Any ideas what I could be doing wrong ? Here's how I init the test worker.

await unstable_dev(entry, {
      experimental: { disableExperimentalWarning: true },
      config: 'wrangler.toml',
    })

await unstable_dev(entry, {
      experimental: { disableExperimentalWarning: true },
      config: 'wrangler.toml',
    })

Which results in the following error.

> Unexpected token F in JSON at position 0
>  ❯ parseJSONFromBytes node_modules/wrangler/wrangler-dist/cli.js:6582:19
>   6580|     __name(utf8DecodeBytes, "utf8DecodeBytes");
>     6581|     function parseJSONFromBytes(bytes) {
>     6582|       return JSON.parse(utf8DecodeBytes(bytes));
>        |                   ^
>     6583|     }
>     6584|     __name(parseJSONFromBytes, "parseJSONFromBytes");

> Unexpected token F in JSON at position 0
>  ❯ parseJSONFromBytes node_modules/wrangler/wrangler-dist/cli.js:6582:19
>   6580|     __name(utf8DecodeBytes, "utf8DecodeBytes");
>     6581|     function parseJSONFromBytes(bytes) {
>     6582|       return JSON.parse(utf8DecodeBytes(bytes));
>        |                   ^
>     6583|     }
>     6584|     __name(parseJSONFromBytes, "parseJSONFromBytes");

^^ update, I figured out what this was. I'm connecting to an AWS RDS instance. We had our certificat

Similar Threads

Similar Threads

Similar Threads