bladepipe/cgdm-sidecar repository overview

⁠CloudDM Sidecar

CloudDM Sidecar is the execution-node component in CloudDM cluster mode. It is responsible for remote database access and task execution, and is suitable for multi-network regions, cross-data-center deployments, and restricted network environments. Sidecar cannot be initialized and used independently. Before startup, you must already have a reachable Console, and the AK / SK / WSN for the current Sidecar must already have been generated.

[Website⁠] [Documentation⁠] [Blog⁠] [Gitee⁠] [GitHub⁠]

⁠What Is CloudDM

CloudDM is a free and open-source database management platform for team collaboration scenarios. It provides access control, data masking, SQL auditing, CI/CD, and cross-region deployment capabilities.

It is not just a SQL query tool, and it is not just a database operations platform. It brings the following capabilities into one web product:

• Unified management for multiple databases and data sources
• Visual interfaces for query, object management, and day-to-day operations
• Audit, risk validation, and approval workflows before SQL execution
• Access control through roles, resources, and temporary authorization
• Database access deployment closer to database networks through the Console + Sidecar architecture

If you need a database platform that can be adopted directly rather than only a lightweight command-line client, CloudDM is a better fit.

⁠Core Capabilities

⁠Query and Development

• Supports MySQL, Oracle, MariaDB, PostgreSQL, SQL Server, DB2, TiDB, ClickHouse, Doris, StarRocks, Redis, MongoDB, and more
• Provides a unified web console, SQL editor, result export, execution plans, transaction control, and syntax highlighting

⁠Database Management

• Supports management of catalogs, schemas, tables, columns, indexes, views, functions, stored procedures, triggers, users, and roles
• Suitable for unified management across multiple environments and instances

⁠Database CI/CD

• Supports Git Push, Web Hook, and HttpCall as CI/CD triggers
• Supports Gitee as a change repository

⁠Security and Permissions

• Supports both resource permissions and functional permissions
• Supports permission requests, grants, temporary authorization, and approval workflows
• Provides SQL auditing, risk interception, and data masking capabilities

⁠Workflow and Collaboration

• Supports SQL audit workflows, permission tickets, and change workflows
• Supports manual, immediate, and scheduled execution modes
• Supports OpenLDAP, OIDC, Windows AD, DingTalk, Feishu, and WeCom integrations for authentication and workflow engines
• Suitable as a shared database access entry point and operating standard for teams

⁠License

CloudDM uses the business-friendly Apache 2.0 license.

⁠Usage

The following examples assume:

• The Console container name is cgdm-console
• The Console communication address for Sidecar is cgdm-console:8008
• Sidecar and Console are in the same Docker network cgdm-net

⁠Before Startup

Complete the following actions in Console:

1. Deploy and initialize Console first
2. Add a Sidecar node in Console
3. Record the generated AK, SK, and WSN
4. Confirm that the environment where Sidecar runs can access APP_SERVE_NAME:APP_SERVE_PORT for Console

⁠Quick Start

After Console has been initialized and you have obtained AK / SK / WSN, you can first start Sidecar with the minimum required parameters:

docker run -d  --name cgdm-sidecar -p 8080:8080 \
  -e APP_WEB_PORT=8080 \
  -e APP_SERVE_NAME=<your clouddm APP_SERVE_NAME> \
  -e APP_SERVE_PORT=<your clouddm APP_SERVE_PORT default is 8008> \
  -e DM_CLIENT_AK=<Worker AK> \
  -e DM_CLIENT_SK=<Worker SK> \
  -e DM_CLIENT_WSN=<Worker WSN>  \
  bladepipe/cgdm-sidecar:3.0.7

For mainland China network environments, you can change the image to the accelerated registry address:

image: cloudcanal-registry.cn-shanghai.cr.aliyuncs.com/clougence/cgdm-sidecar:3.0.7

⁠Network Connectivity

The following methods can all be used to make Sidecar reach Console. You only need to choose the one that fits your deployment environment:

1. Same machine, same Docker network. Run docker network create cgdm-net first, then start both Console and Sidecar with --network cgdm-net. In this case, APP_SERVE_NAME can be set directly to the Console container name, for example cgdm-console.

2. Same machine, but Console runs on the host. In this case, the Sidecar container must be able to access the host IP, and APP_SERVE_NAME should be the host address, for example 192.168.1.10. Also make sure that port 8008 on the host is open to the container network.

3. Different machines connected through a LAN. If Console is deployed on another server, APP_SERVE_NAME can be the internal IP or a reachable domain name of the machine where Console runs. You also need to allow access between the two machines to APP_SERVE_PORT.

4. Access through reverse proxy, SLB, or load balancer. If Console is already placed behind Nginx, a layer-4 load balancer, or a cloud load balancer, set APP_SERVE_NAME to the proxied domain name or address. This is suitable when Sidecar and Console are not in the same network plane and need a unified exposed entry.

5. Deployment in Kubernetes or a cloud network environment. If Console is exposed as a Kubernetes Service, Ingress, or a cloud private-service address, set APP_SERVE_NAME to the corresponding Service DNS, Ingress domain name, or private address. The key point is not whether cgdm-net is used, but whether the environment where Sidecar runs can access APP_SERVE_NAME:APP_SERVE_PORT.

No matter which method you choose, the rule is the same: APP_SERVE_NAME:APP_SERVE_PORT must be reachable from the environment where Sidecar runs.

⁠Environment Variables

Except for APP_WEB_PORT, the other values are recommended to be set explicitly in real deployments.

⁠Data Volumes

Recommendations:

• If you want to retain Sidecar credentials and configuration, at least mount conf
• If you want to retain runtime logs, mount logs
• If you want to retain runtime cache and local data, mount data

⁠Port Description

The core Sidecar-to-Console connection is an active outbound connection to APP_SERVE_NAME:APP_SERVE_PORT, not a connection initiated back by Console.

⁠Important Rule

Sidecar generates configuration from environment variables only when the configuration files do not yet exist:

• /root/cgdm/sidecar/conf/global_conf.properties
• /root/cgdm/sidecar/conf/sidecar.properties