1182372 - Access denied errors when using |manage.py run_sql| on Heroku due to lack of SSL settings

Status: RESOLVED FIXED

(Tree Management :: Treeherder, defect, P2)

Description

[Ed Morley [:emorley]]

eg:

~ $ ./manage.py run_sql -s "ALTER TABLE job_log_url DROP COLUMN parse_timestamp;"
SQL command: ALTER TABLE job_log_url DROP COLUMN parse_timestamp;
44 datasource found
--------------------------
Traceback (most recent call last):
  File "./manage.py", line 15, in <module>
    execute_from_command_line(sys.argv)
  File "/app/.heroku/python/lib/python2.7/site-packages/django/core/management/__init__.py", line 385, in execute_from_command_line
    utility.execute()
  File "/app/.heroku/python/lib/python2.7/site-packages/django/core/management/__init__.py", line 377, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/app/.heroku/python/lib/python2.7/site-packages/django/core/management/base.py", line 288, in run_from_argv
    self.execute(*args, **options.__dict__)
  File "/app/.heroku/python/lib/python2.7/site-packages/django/core/management/base.py", line 338, in execute
    output = self.handle(*args, **options)
  File "/app/treeherder/model/management/commands/run_sql.py", line 85, in handle
    passwd=settings.TREEHERDER_DATABASE_PASSWORD)
  File "/app/.heroku/python/lib/python2.7/site-packages/MySQLdb/__init__.py", line 81, in Connect
    return Connection(*args, **kwargs)
  File "/app/.heroku/python/lib/python2.7/site-packages/MySQLdb/connections.py", line 193, in __init__
    super(Connection, self).__init__(*args, **kwargs2)
_mysql_exceptions.OperationalError: (1045, "Access denied for user 'th_admin'@'<snip>-108.compute-1.amazonaws.com' (using password: YES)")

What's strange is that the full "treeherder-heroku.<snip>.us-east-1.rds.amazonaws.com" style DB hostname does not resolve to the host mentioned in the error.

I've tried a manage.py clear_cache, but that didn't help.

I've also checked all entries in the datasource table have the correct full host name, which they do.

Strange; will dig in more another time when I'm less sleepy.

Comment 1

[Ed Morley [:emorley]]

Ah this is because run_sql rolls it's own MySQLdb.connect() that doesn't set the CA cert options.

Comment 2

[Ed Morley [:emorley]]

Attachment: Pass the database SSL options to MySQLdb.connect()

Comment 3

[Treeherder GitHub Bugbot]

Commit pushed to master at https://github.com/mozilla/treeherder

https://github.com/mozilla/treeherder/commit/a295fcb0f7ca50cbe965f058f339be79a864e7b5
Bug 1182372 - Pass the database SSL options to MySQLdb.connect()

Since otherwise we get access denied errors using run_sql on Heroku.
All other calls use datasource, so have already been set up to pass the
SSL options.

Comment 4

[Ed Morley [:emorley]]

Is working on heroku now :-)
(See bug 1179011 comment 1)