Microservices Engine:Data source management

Core capabilities

Data source management is a universal solution designed to address these challenges:

• Encrypted storage: KMS encrypts and stores data source credentials, eliminating the risk of plain text exposure.

• Automated rotation: Integrates with KMS to enable scheduled credential rotation, supporting seamless runtime updates without application restarts.

• Configuration-based access: Applications read data source information from the Nacos Configuration Center, enabling integration without any code changes.

Prerequisites

Create a data source

1. On the instance list page of your registry and configuration center, click the name of the target instance and choose Data Source Management.

   If you have not bound a KMS key, a dialog box appears. Follow the prompts to bind a KMS key.

2. Select the target Namespace and click Create Data Source. Configure the following parameters:

   • Data Source Name: Enter a name for the data source.

   • Description: Enter a description for the data source. For example: "Internal data source for Application A to access Database XX".

   • Data Source Type:

     • spring-datasource: For Java Spring applications that access a relational database such as MySQL, ApsaraDB RDS, or PolarDB.

     • spring-redis: For Java Spring applications that access a cache database such as ApsaraDB for Redis or Tair. Application access for this type will be available soon.

   • Subtype: Currently, only the open source connection pool Druid is supported.

   • Database Type: Select the database type, and then select the database instance.

   • Database Instance Endpoint: For example, rm-02345**********imo.mysql.rds.aliyuncs.com.

   • Database Engine Type: Currently supports MySQL, SQL Server, PostgreSQL, and MariaDB. This affects the format of the JDBC connection string the application uses.

   • Database Port: The port number of the database, for example, 3306.

   • Database Name: The name of the database.

   • Database URL Parameters: Additional JDBC parameters beyond the endpoint, port, and database name. For example: connectTimeout=20000&socketTimeout=60000&serverTimeZone=Asia/Shanghai.

   • Initial Size: The initial number of connections in the application-side connection pool.

   • Min Idle: The minimum number of connections to keep active when the service is idle.

   • Max Active: The maximum number of connections allowed during high-concurrency scenarios.

   • Max Wait: The maximum time a business request will wait for a connection from the pool.

   • Initial Size: The initial number of connections in the application-side connection pool.

   • Min Idle: The minimum number of connections to keep active when the service is idle.

   • Max Active: The maximum number of connections allowed during high-concurrency scenarios.

   • Max Wait: The maximum time a business request will wait for a connection from the pool.

   • Associated KMS Credential (Important): Select a KMS credential. This credential stores the username and password for database access.

     • You can select a database credential or a generic credential. If you use a generic credential, ensure that its value is a JSON object that contains the AccountName and AccountPassword fields.

     • If you specify a database instance and database name when you configure the KMS credential, the system validates them against the database instance associated with the data source. This helps prevent configuration errors.

   • More Parameters: You can set additional parameters beyond the common ones, such as testWhileIdle, testOnBorrow, and testOnReturn. Example:

     # Specifies whether to enable idle connection testing.
     spring.datasource.druid.testWhileIdle=true
     # Specifies whether to test connections when they are borrowed from the pool. We recommend that you disable this.
     spring.datasource.druid.testOnBorrow=false
     # Specifies whether to test connections when they are returned to the pool. We recommend that you disable this.
     spring.datasource.druid.testOnReturn=false

3. Click OK. In the Confirm Data Source Creation dialog box, click OK again to submit the data source.

Data source details

On the Data Source Management page, click a data source name to view its details page:

• Raw Configuration Content: You can view the Data ID, Group, and content of the underlying configuration. The plain text content is displayed only in the console.

  The data source management feature is built on the Nacos Configuration Center, where it stores data source configurations in an encrypted format.

• Listener Queries: This tab reuses the listener query feature of the Configuration Center. You can view the application nodes listening to this data source.

• Change Events:

  • Records events such as data source creation, updates, and credential rotations. You can view a comparison of the content before and after a change in the event details.

  • For credential rotation events, navigate to the KMS credential management page to view the credentials before and after the change.

• Push History: This tab reuses the push history feature of the Configuration Center, which records configuration changes and push events for the data source.

Edit a data source

On the Data Source Management page, click Edit next to the target data source.

Credential rotation

KMS provides the credential rotation feature for data sources. There are two rotation methods:

• Scheduled rotation: You can set a rotation schedule when you create a credential, and it will rotate automatically at the specified interval.

• Immediate rotation: If credentials are leaked or need to be changed immediately, you can perform an immediate rotation from the KMS credential management console.

When a KMS credential rotates, either on a schedule or manually, KMS notifies MSE Nacos. Nacos then updates the encrypted data source configuration and pushes the update to the application to refresh the credentials. Druid gracefully replaces the online connections to ensure zero impact on your business.

Delete a data source

On the Data Source Management page, click Delete next to the target data source and enter the data source name to confirm.

Note:

• Deleting a data source also deletes the associated encrypted configuration from the underlying Configuration Center. This action cannot be undone. Proceed with caution.

• The application provides runtime exception protection for data source deletions to ensure that existing online connections are not affected. However, the application will fail to start if the data source is deleted.

Application access

On the data source details page, click Application Access to view the integration steps for each data source.

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>druid</artifactId>
    <version>1.2.25</version>
</dependency>

<dependency>
    <groupId>com.alibaba.cloud</groupId>
    <artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
    <version>2023.0.3.3</version>
</dependency>

# Import the data source configuration into Spring to initialize the data source.
spring.config.import[0]=optional:nacos:cipher-kms-aes-256-proxy-spring-{resourceName}.properties?group=nacos-datasource

# Specify the Nacos address. The default is a public endpoint. Modify it as needed.
spring.cloud.nacos.config.server-addr={nacos server}
# Specify the namespace.
spring.cloud.nacos.config.namespace={namespace ID}
# Specify the KMS region ID.
spring.cloud.nacos.config.kms_region_id={instance region}

# Enable Druid data source management and specify the Data ID of its encrypted configuration.
spring.nacos.config.proxy.druid.enabled=true
spring.nacos.config.proxy.druid.data-id={dataID}

FAQ