Django, MySQL, and SSL certs: strings instead of filenames?

Danielle M. 0
Viewed 34

I'm attempting to configure a Django application to connect to a MySQLDB instance with TLS configured.

Django's DATABASES settings documents how to configure the ssl settings, for eg.:

DATABASES = {
    'default': {
        'ENGINE':   os.environ.get('DATABASE_ENGINE', 'django.db.backends.mysql'),
        'HOST':     os.environ.get('DATABASE_HOST'),
        'PASSWORD': get_vault_secret('DATABASE_PASSWORD'),
...

        'OPTIONS': {
            'ssl': {
                'ca': '/ca/server.cert.pem',
                'cert': '/ca/client.cert.pem',
                'key': '/ca/client.key.pem'
            }
        }
    },
}

Our problem is that the values required for ca, cert, and key are filenames. Our app is containerized, and we pull all of our secrets from hashicorp Vault during app initialization using a helper func (see the value for PASSWORD).

We also store client certs, keys, etc in vault, and would like to supply these to Django directly - but MySQL demands a string, pointing to a file.

Is there a way to wrap the cert / ca / key strings we get from vault into some kind of IOFile / BytesIO esque container to pass from Django, to python mysqlclient, to mysql_ssl_set()?

Due to security considerations, actually writing these values to a file is not an option.

mysql django python
1 Answers

You could use an entrypoint.sh script for your container which can fetch the files from your vault first and then start the django process. Make sure to add set -e to the script so that the container is restarted if the fetch fails. Otherwise you'd just end up with unable to connect errors

Gaurav Agarwal0
Related