CockroachDB 2.1.5 restores proxy behavior in external storage
External HTTP storage now preserves proxy and connection defaults while adding custom certificate authorities. The release also represents explicit index-scan direction in SQL hints.
Adding a custom TLS configuration can accidentally remove unrelated HTTP behavior. CockroachDB 2.1.5 changes the transport used by external storage so that it retains standard proxy selection and several connection defaults. The previous implementation built a new transport containing the TLS configuration alone.
The difference is visible in the 2.1.5 storage implementation and its 2.1.4 predecessor. The newer version copies selected fields from Go's default HTTP transport before applying the custom TLS settings. Proxy selection is one of those fields.
I accept the network costs of distributed SQL when the consistency benefits justify them. External storage adds a different network path whose behavior should be equally explicit. A database process that can reach other database nodes may still need a proxy to reach a backup or import location.
A default transport has behavior beyond TLS
The old helper returned a client with a newly constructed transport whose only configured field was TLSClientConfig. That preserved the custom certificate-authority work but did not inherit every setting from the standard default transport.
Version 2.1.5 copies the default transport's proxy function, dial context and selected timeout and connection-pool settings. Its source comment explains why it does not copy the entire structure. The structure contains a mutex, so wholesale copying would be inappropriate.
This is a concrete example of configuration composition. Starting with an empty structure and setting one field does not necessarily mean using the normal defaults plus one override. Some defaults exist as values on a preconfigured object, and creating another object leaves those values behind.
The implementation also acknowledges the maintenance cost of copying fields individually. If Go adds default transport fields, they will not automatically appear in this helper. The fix makes the intended inheritance explicit while retaining a responsibility to keep the selected defaults aligned with future library changes.
The practical improvement is broader than a single environment-variable lookup. Connection establishment and connection reuse now use several settings taken from the default transport. That helps explain the implementation change without assuming that the patch alters every network client in the database.
Proxy variables belong to the process opening the connection
The Go 1.10.3 HTTP transport source defines the default proxy function as ProxyFromEnvironment. Its documented inputs include HTTP_PROXY, HTTPS_PROXY and NO_PROXY, along with lowercase forms.
The function can return no proxy when none is configured or when the destination is excluded. For HTTPS requests, it prefers the HTTPS setting. These rules belong to the HTTP transport making the request.
For CockroachDB external storage, that means the relevant environment is the environment of the database process constructing the storage client. Setting a variable only in an unrelated interactive SQL client's shell does not configure that server-side process. The network request originates where the storage implementation runs.
The distinction matters in restricted networks. A SQL connection proves that a client can reach the database. It does not prove that the database can reach an external HTTP destination or that it will use the required outbound proxy.
My preference is to diagnose those paths independently. The transport change gives external storage the standard proxy-selection mechanism. It does not remove the need for the configured proxy and destination to be reachable from the process that performs the operation.
Custom certificate authorities remain part of the client
The helper still reads the cloudstorage.http.custom_ca setting. When a certificate is configured, it loads the system certificate pool and appends the supplied certificate material. Failure to load or append the certificates returns an error.
The new transport retains that TLS configuration while copying the other defaults. Supporting a proxy therefore does not mean discarding the custom trust configuration. The change brings these settings together in the same constructed client.
The S3 implementation also invokes this helper when using a configured custom endpoint. That is a specific relationship visible in the versioned code. Ordinary S3 client construction and custom-endpoint construction should not be treated as identical merely because both ultimately perform HTTP requests.
SQL can describe a forced scan direction
Another 2.1.5 change is visible in the SQL index-flag representation. Index hints can carry an ascending or descending direction together with a forced index.
The validation code requires a direction to accompany an index and rejects conflicting repeated direction flags. Formatting emits the direction inside the explicit index-hint form. This gives the query a way to express a scan-direction choice without relying solely on the planner's default selection.
That is separate from the networking repair, but it shares an emphasis on making an operational choice explicit. A proxy setting describes how a storage request leaves the process. An index hint describes a constrained access choice within SQL planning. Version 2.1.5 preserves standard HTTP behavior in one implementation and adds a defined representation for scan direction in the other.