This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS CA requires the clien
This is because Hyperdrive doesn’t yet support custom CAs, and the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.
MFor clarity, after re-reading your message: this is via Hyperdrive, right? Not just
connect() directly?
CI'm a little bit confused here. The docs do call out custom CA certs, but the default mode in
pg (not sure what Hyperdrive->AWS is using) doesn't verify certificates
CCorrect.
connect() directly w/ sslmode=REQUIRE doesn't verify the certs, so it works as expectedCIt's only when connecting via Hyperdrive, which I'm assuming is verify-ca or verify-full
MNo, per the docs: Hyperdrive does not support those modes. We only support
require (and prefer, but we ultimately require TLS).Cand the “newer” AWS CA requires the client (Hyperdrive) to have it in its trust store.I'm a little unsure what you meant by this bit then
CIf we're only using
require wouldn't cert validation not take place?MLet's step back a second.
- You are using Hyperdrive and having issues when using the
rds-ca-rsa2048-g1CA, correct? - When using the raw TCP
connect()API without Hyperdrive you have no issues, correct?
Ccorrect
MThey both share the same egress/TLS path, so this is odd. We shouldn't be validating the cert.
M(We'll look into it)
CI should add there’s a little bit of fuzziness - I couldn’t immediately see results when changing the database CA, it took <=10m
MAWS says that changing the CA is not an immediate action
CI interpreted that in the context of it waiting for the next maintenance window (which we forced immediately), not that there’d be propagation delay
CBut that is definitely possible
Cand I’m only assuming the underlying issue is cert validation - the error message was very vague
CSure thing, I added you
KOn normal Workers it requires
node_compat which is a set of polyfills (https://github.com/ionic-team/rollup-plugin-node-polyfills/) so I'm not sure if you'd be able to get that working alongside next-on-pagesKDifferent thing.
KThe Pages team don't plan to add
node_compat to Pages, maybe you can ask the next-on-pages team to add it to that framework.Cnode-postgres - other drivers requiring
node_compatis a result of the individual drivers, not Hyperdrive, correct?
KYeah
KHyperdrive as far as your Worker is concerned is just a connection string
CI wonder what part of those libs require it + if we'll ever get a "WinterCG-native" PG driver, since I don't think(?)
connect() itself requires itKI don't think it actually requires them, but they're not conditionally required - esbuild sees they're there, and can't tell that they won't be used at runtime with Workers.
CI thought that's what separate workerd entrypoint solves
C^^ or could solve, again I have zero knowledge of these drivers
Knode-postgres doesn't have those, so possibly, but I have no ideaCyeah me neither, and it doesn't impact our Worker luckily, but I've seen a lot of people having the
node_compat vs nodejs_compat dilemma in this channel so far
AHow to use hyperdrive in pages functions?
JUnfortunately Pages Functions doesn’t support node_compat bundling, nor the hyperdrive binding, so I’m not aware of a simple way to get hyperdrive working with Pages, sorry
J[ERROR] A request to the Cloudflare API (/accounts/cloudflare_account_id/hyperdrive/configs) failed.
not_entitled [code: 10000]
i got this error while using wrangler hyperdrive create name --connection-string="connection_string"
not_entitled [code: 10000]
i got this error while using wrangler hyperdrive create name --connection-string="connection_string"
Janyone
SAre you on the paid workers plan?
JYes
MCan you share your account ID please? (it's safe to share publicly)
J1d1c3f97856c67d63a1d69697bcb3b0d
MYou do not have a paid Workers plan.
MHyperdrive (currently) requires a paid Workers plan per https://developers.cloudflare.com/hyperdrive/get-started/#prerequisites / https://developers.cloudflare.com/workers/platform/pricing/#workers
Jthis is the test account where we test the things before the production
Jso i think we need to login with that account through wrangler
MYep. You can use
CLOUDFLARE_ACCOUNT_ID as an env var too: https://developers.cloudflare.com/workers/wrangler/configuration/#inheritable-keysWrangler optionally uses a wrangler.toml configuration file to customize the development and deploying setup for a Worker.
Jthx it's works
HHey team, I'm integrating Hyperdrive on an existing project and it works great.
However when I run the tests using
Any ideas what I could be doing wrong ? Here's how I init the test worker.
Which results in the following error.
However when I run the tests using
unstable_dev my tests are failing with the following error.Any ideas what I could be doing wrong ? Here's how I init the test worker.
Which results in the following error.
HAFAIK
unstable_dev is local-only, so it might be failing because Hyperdrive doesn't work locally?