[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThe \u003ccode\u003eextraFilesToStage\u003c/code\u003e template parameter allows for dynamic staging of files on Dataflow worker VMs before data processing, including SSL certificate files.\u003c/p\u003e\n"],["\u003cp\u003eFiles staged using \u003ccode\u003eextraFilesToStage\u003c/code\u003e are stored in the \u003ccode\u003e/extra_files\u003c/code\u003e directory on each worker, and can be referenced in other parameters using relative paths.\u003c/p\u003e\n"],["\u003cp\u003eThis parameter supports staging both Cloud Storage files and Secret Manager secrets, enabling use cases like storing SSL certificates and accessing secrets, as the parameter can be used to manage credentials or other secrets.\u003c/p\u003e\n"],["\u003cp\u003eJDBC templates can utilize \u003ccode\u003eextraFilesToStage\u003c/code\u003e to stage SSL certificates for secure database connections, referencing them within the JDBC connection URL or properties, with examples provided for both PostgreSQL and MySQL database connections.\u003c/p\u003e\n"],["\u003cp\u003eYou can use \u003ccode\u003eJvmInitializer\u003c/code\u003e to perform one-time initialization on all Dataflow Java workers, as well as use \u003ccode\u003eextraFilesToStage\u003c/code\u003e in some templates to stage dynamic files, such as storing certificate and key files, or managing Secret Manager secrets.\u003c/p\u003e\n"]]],[],null,["# Use SSL certificates with templates\n\nThis page explains how to stage files on Dataflow worker VMs\nto use SSL certificates with the Google-provided Java Database Connectivity\n(JDBC) templates. You can also use the steps in this page to stage files\ndynamically on the worker VM before processing begins.\n\nStage files on worker VMs\n-------------------------\n\nWith some templates, you can stage files on Dataflow worker VMs by using\nthe `extraFilesToStage` template parameter. Use this parameter to\nstage files dynamically on the worker VM before data processing begins.\nYou might use this parameter in the following cases:\n\n- Store certificate and key files on each worker for SSL connections.\n- Because Dataflow doesn't include built-in support for Secret Manager, use this parameter to configure templates to store and access Secret Manager secrets.\n\nThis parameter is available in some but not all templates.\nTo see if the parameter is available with the template that you're using,\nsee the template parameters table for your template in\n[Google-provided Dataflow streaming templates](/dataflow/docs/guides/templates/provided-templates#streaming-templates)\nor [Google-provided Dataflow batch templates](/dataflow/docs/guides/templates/provided-templates#batch-templates).\n\nWhen you use this parameter, comma separated Cloud Storage paths or\nSecret Manager secrets are passed to the worker and saved in the\n`/extra_files` directory on each worker.\nWhen the files are saved in the `/extra_files` directory, other parameters can\nreference them. To reference the files, in the configuration properties, specify\nfile paths relative to the `/extra_files` directory.\n\nAll Cloud Storage files passed using this parameter are\nstored in the `/extra_files` directory with the same filename.\nSecret Manager secrets are stored in the `/extra_files` directory with the\nsecret name used as the filename.\n\nFor example, when you set `extraFilesToStage` to the following path, the files are\nstored in the `/extra_files` directory of each worker with the filenames\n`file.txt` and \u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e. \n\n gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/file.txt,projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/secrets/\u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e/versions/\u003cvar translate=\"no\"\u003eVERSION_ID\u003c/var\u003e\n\nConfigure SSL certificates\n--------------------------\n\nWith templates that use JDBC to read or write, you can use the\n`extraFilesToStage` template parameter to stage certificates as local files\non worker VMs, and then reference the local filename in the JDBC connection URL\nor in the connection properties.\n\nJDBC SSL connections differ based on the database. This section provides\nexamples for PostgreSQL and MySQL databases.\n\nIf you need to set Java system properties, use\n[`JvmInitializer`](https://beam.apache.org/releases/javadoc/current/org/apache/beam/sdk/harness/JvmInitializer.html).\nYou can use `JvmInitializer` to perform one-time initialization on all Dataflow Java workers.\n\n### PostgreSQL\n\nFor SSL connections in PostgreSQL databases, the following parameters are\navailable: `ssl`, `sslmode`, `sslcert`, `sslkey`, and `sslrootcert`.\n\n- To specify that the connection should use SSL and what mode to use, use the `ssl` and `sslmode` parameters.\n- For client validation, use the `sslcert` and `sslkey` parameters.\n- For server validation, use the `sslrootcert` parameter.\n\nWhen you connect to PostgreSQL, set the following parameters: \n\n extraFilesToStage=gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/root_cert.crt,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/cert.crt,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/key.key\n\n connectionUrl=jdbc:postgresql://\u003cvar translate=\"no\"\u003eHOST\u003c/var\u003e/\u003cvar translate=\"no\"\u003eDATABASE\u003c/var\u003e?ssl=true&sslrootcert=/extra_files/root_cert.crt&sslcert=/extra_files/cert.crt&sslkey=/extra_files/key.key&\u003cvar translate=\"no\"\u003eOTHER_PARAMETERS\u003c/var\u003e...\n\nFor additional PostgreSQL JDBC configuration parameters and more details about\nthe parameters, see [Connection Parameters](https://jdbc.postgresql.org/documentation/use/#connection-parameters)\nin the JDBC PostgreSQL documentation.\n\n### MySQL\n\nFor SSL connections in MySQL databases, the following parameters are\navailable: `sslmode`, `trustCertificateKeyStoreUrl`, and\n`clientCertificateKeyStoreUrl`.\n\n- To specify that the connection should use SSL and what mode to use, use the `sslmode` parameter.\n- For client validation, use the `clientCertificateKeyStoreUrl` parameter.\n- For server validation, use the `trustCertificateKeyStoreUrl` parameter.\n\nWhen you connect to MySQL, set the following parameters: \n\n extraFilesToStage=gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/truststore.jks,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/cert.crt,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/keystore.jks\n\n connectionUrl=jdbc:mysql://\u003cvar translate=\"no\"\u003eHOST\u003c/var\u003e/\u003cvar translate=\"no\"\u003eDATABASE\u003c/var\u003e?sslmode=REQUIRED&trustCertificateKeyStoreUrl=file:/extra_files/truststore.jks&sslcert=file:/extra_files/keystore.jks&\u003cvar translate=\"no\"\u003eOTHER_PARAMETERS\u003c/var\u003e...\n\nFor additional MySQL JDBC configuration parameters and more details about\nthe parameters, see the\n[security connectors](https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-connp-props-security.html)\npage in the MySQL documentation.\n\n### SSL connection example\n\nThe following example demonstrates how to run the\n[Pub/Sub to JDBC](/dataflow/docs/guides/templates/provided/pubsub-to-jdbc)\ntemplate with SSL connections in a MySQL database. \n\n #!/bin/bash\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n echo \"Running template ...\"\n gcloud dataflow flex-template run my-job \\\n --template-file-gcs-location=\"gs://dataflow-templates-\u003cvar translate=\"no\"\u003eREGION_NAME\u003c/var\u003e/latest/flex/Pubsub_to_Jdbc\" \\\n --region=\"\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\" \\\n --parameters= \\\n driverClassName=\"com.mysql.jdbc.Driver\",\\\n connectionUrl=\"jdbc:mysql://\u003cvar translate=\"no\"\u003eHOST\u003c/var\u003e/\u003cvar translate=\"no\"\u003eDATABASE\u003c/var\u003e?sslmode=REQUIRED&trustCertificateKeyStoreUrl=file:/extra_files/truststore.jks&sslcert=file:/extra_files/keystore.jks\",\\\n driverJars=\"gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/mysql.jar\",\\\n statement=\"INSERT INTO tableName (column1, column2) VALUES (?,?)\",\\\n inputSubscription=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/subscriptions/subscription\",\\\n outputDeadletterTopic=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/topics/topic\",\\\n extraFilesToStage=\"gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/truststore.jks,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/cert.crt,gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/keystore.jks\""]]
