<div dir="ltr">Hey Radim!<div><br></div><div>Comments inlined.</div><div><br></div><div>Thanks</div><div>Sebastian<br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, May 9, 2016 at 12:55 PM, Radim Vansa <span dir="ltr"><<a href="mailto:rvansa@redhat.com" target="_blank">rvansa@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">As for the questions:<br>
* Is SSL required for SNI? I can imagine that multi-tenancy would make<br>
sense even in situations when the connection does not need to be<br>
encrypted. Moreover, if we plan to eventually have HR clients with async<br>
API (and using async I/O), SSL is even more PITA. Btw., do we have any<br>
numbers how much SSL affects perf? (that's a question for QA, though)<br></blockquote><div><br></div><div>Unfortunately no. SNI is an extension of TLS [2] which is an upgrade of SSL. In Java SNI Host names are specified in SSLParameters [3].</div><div><br></div><div>Of course SSL slows things down a bit, that's why we also need a "switch-to-tenant" command which would be used by the clients who do not want SSL. However if someone uses SNI and SSL (and only then) we can switch him to proper tenant automatically (because we have enough information at that point).</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
* I don't think that dynamic switching of tenants would make sense,<br>
since that would require to invalidate all RemoteCache instances, near<br>
caches, connection pools, everything. So it's the same as starting from<br>
scratch.<br></blockquote><div><br></div><div>Frankly I also have a mixed feelings about this feature. I think it would be much nicer if we switched to another tenant by doing disconnect/connect sequence (and not switching dynamically).</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
R.<br>
<span class=""><br>
<br>
<br>
<br>
<br>
On 04/29/2016 05:29 PM, Sebastian Laskawiec wrote:<br>
> Dear Community,<br>
><br>
> Please have a look at the design of Multi tenancy support for<br>
> Infinispan [1]. I would be more than happy to get some feedback from you.<br>
><br>
> Highlights:<br>
><br>
</span>> * The implementation will be based on a Router (which will be built<br>
> based on Netty)<br>
> * Multiple Hot Rod and REST servers will be attached to the router<br>
<span class="">> which in turn will be attached to the endpoint<br>
</span>> * The router will operate on a binary protocol when using Hot Rod<br>
<span class="">> clients and path-based routing when using REST<br>
</span>> * Memcached will be out of scope<br>
> * The router will support SSL+SNI<br>
<span class="im">><br>
> Thanks<br>
> Sebastian<br>
><br>
> [1]<br>
> <a href="https://github.com/infinispan/infinispan/wiki/Multi-tenancy-for-Hotrod-Server" rel="noreferrer" target="_blank">https://github.com/infinispan/infinispan/wiki/Multi-tenancy-for-Hotrod-Server</a></span></blockquote><div>[2] <a href="https://tools.ietf.org/html/rfc6066#page-6">https://tools.ietf.org/html/rfc6066#page-6</a> </div><div>[3] <a href="https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#getServerNames--">https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#getServerNames--</a></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="im"><br>
><br>
><br>
</span><span class="im">> _______________________________________________<br>
> infinispan-dev mailing list<br>
> <a href="mailto:infinispan-dev@lists.jboss.org">infinispan-dev@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/infinispan-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/infinispan-dev</a><br>
<br>
<br>
</span><span class=""><font color="#888888">--<br>
Radim Vansa <<a href="mailto:rvansa@redhat.com">rvansa@redhat.com</a>><br>
JBoss Performance Team<br>
</font></span><div class=""><div class="h5"><br>
_______________________________________________<br>
infinispan-dev mailing list<br>
<a href="mailto:infinispan-dev@lists.jboss.org">infinispan-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/infinispan-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/infinispan-dev</a><br>
</div></div></blockquote></div><br></div></div></div>