feat(kernel): wire ABI-version check, mTLS, and CloudFetch toggle options#410
Draft
mani-mathur-arch wants to merge 1 commit into
Draft
feat(kernel): wire ABI-version check, mTLS, and CloudFetch toggle options#410mani-mathur-arch wants to merge 1 commit into
mani-mathur-arch wants to merge 1 commit into
Conversation
…ions
Wire the four new kernel C-ABI symbols on the driver side, extending the
existing experimental-config surface:
- checkABIVersion(): a sync.Once handshake at the top of OpenSession compares
the linked library's kernel_abi_version() against the header's
DATABRICKS_KERNEL_ABI_VERSION and refuses to connect on a mismatch, so a
differently-built prebuilt .a can't be silently misread.
- WithKernelClientCertificate(cert, key): mTLS client identity forwarded via
the paired kernel_session_config_set_tls_client_certificate. Both PEM halves
are required together — validateKernelConfig rejects an unpaired credential
loudly so a lone key can't be silently dropped — and the key is never logged.
- WithKernelCloudFetch(enabled): a tri-state *bool (nil keeps the kernel
default on; set forwards kernel_session_config_set_cloudfetch_enabled).
Distinct from the plain-bool WithCloudFetch, whose unset state can't be told
from false.
All three are kernel-only and rejected loudly on the Thrift path (the connector
fails when KernelExperimental is non-nil). The reflective classification guard is
extended so a new experimental field can't ship unforwarded/unrejected.
CloseSession stays fire-and-forget: the C ABI now also offers
kernel_session_close_blocking, but adopting it would make close a blocking
network round-trip with no deadline honored, so swapping to it is grouped with
the cancellable-close follow-up.
Requires the kernel ABI-version / mTLS / CloudFetch symbols; bump KERNEL_REV to
the merged kernel revision before this builds in CI (it links a locally-staged
archive today).
Tests: experimental-field classification guard + option wiring + Thrift
rejection + DeepCopy (untagged); TestSetKernelTLS mTLS case, TestABIVersionMatches,
and mTLS-pairing validation (tagged / config). Default CGO_ENABLED=0 build
unchanged.
Co-authored-by: Isaac
Signed-off-by: Mani Kaustubh Mathur <mani.mathur@databricks.com>
mani-mathur-arch
force-pushed
the
mani/sea-kernel-tier2-features
branch
from
July 16, 2026 15:13
a067a22 to
c54f051
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wire the four new kernel C-ABI symbols on the driver side, extending the existing experimental-config surface:
checkABIVersion()— async.Oncehandshake at the top ofOpenSessioncompares the linked library'skernel_abi_version()against the header macro and refuses to connect on a mismatch.WithKernelClientCertificate(cert, key)— mTLS client identity via the paired setter. Both PEM halves required together (validateKernelConfigrejects an unpaired credential loudly); the key is never logged.WithKernelCloudFetch(enabled)— a tri-state*bool(nil keeps the kernel default on; set forwards the toggle). Distinct from the plain-boolWithCloudFetch.All three are kernel-only and rejected loudly on the Thrift path; the reflective classification guard is extended so a new experimental field can't ship unforwarded/unrejected.
CloseSessionstays fire-and-forget (adoptingkernel_session_close_blockingwould make close a blocking round-trip with no deadline — grouped with the cancellable-close follow-up).Closes PECOBLR-3648 / 3652 / 3653 (driver side).
Tests
DeepCopy(all underCGO_ENABLED=0); mTLS-pairing validation.TestSetKernelTLSmTLS marshalling case,TestABIVersionMatches. Live-verified on staging (WithKernelCloudFetch(true)connects;(false)reaches the server and hits the documentedCAN_CLOUD_DOWNLOADgate). Default build unchanged.Co-authored-by: Isaac