Skip to content

Commit 7f99389

Browse files
inelpandzicinelpandzic
authored
K8SPS-205: Update user passwords properly (#407)
* Remove transaction from userexec. * Update internal secrets before discarding the old passwords. * Add gr-users test. Implement replication user update with mainainance mode. * Exit * Wait in readiness probe. * Remove GR restart on replication user. * Update ps-entrypoint. * Don't create replication user if GR enabled. * Update gr-users e2e tests. * Cleanup * Improve full-cluster-crash in CR status update. * Implmenet password propagation check. * Spelling fix. * Fix retrieving all users. * Fix creating replication user in entrypoint. * Fix users test and update pass propagation logic. * Improve pass propagation. * Add gr-users to test runs. * Fix gr-users test. * Reorder tests. * Increase timeout for test. * Increase timeout * Updated e2e test. * Fix drop finalizer step.
1 parent 2251903 commit 7f99389

30 files changed

+522
-263
lines changed

‎api/v1alpha1/perconaservermysql_types.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,6 @@ const (
410410
UserOperator SystemUser = "operator"
411411
UserOrchestrator SystemUser = "orchestrator"
412412
UserPMMServerKey SystemUser = "pmmserverkey"
413-
UserProxyAdmin SystemUser = "proxyadmin"
414413
UserReplication SystemUser = "replication"
415414
UserRoot SystemUser = "root"
416415
UserXtraBackup SystemUser = "xtrabackup"

‎build/ps-entrypoint.sh

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
275275
# no, we don't care if read finds a terminating character in this heredoc
276276
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
277277
read -r -d '' rootCreate <<-EOSQL || true
278-
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
278+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' PASSWORD EXPIRE NEVER;
279279
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
280280
EOSQL
281281
fi
@@ -288,9 +288,20 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
288288
file_env 'OPERATOR_ADMIN_PASSWORD' '' 'operator'
289289
file_env 'XTRABACKUP_PASSWORD' '' 'xtrabackup'
290290
file_env 'HEARTBEAT_PASSWORD' '' 'heartbeat'
291+
291292
read -r -d '' monitorConnectGrant <<-EOSQL || true
292293
GRANT SERVICE_CONNECTION_ADMIN ON *.* TO 'monitor'@'${MONITOR_HOST}';
293294
EOSQL
295+
296+
if [ "$CLUSTER_TYPE" == 'async' ]; then
297+
read -r -d '' replicationCreate <<-EOSQL || true
298+
CREATE USER 'replication'@'%' IDENTIFIED BY '${REPLICATION_PASSWORD}' PASSWORD EXPIRE NEVER;
299+
GRANT DELETE, INSERT, UPDATE ON mysql.* TO 'replication'@'%' WITH GRANT OPTION;
300+
GRANT SELECT ON performance_schema.threads to 'replication'@'%';
301+
GRANT SYSTEM_USER, REPLICATION SLAVE, BACKUP_ADMIN, GROUP_REPLICATION_STREAM, CLONE_ADMIN, CONNECTION_ADMIN, CREATE USER, EXECUTE, FILE, GROUP_REPLICATION_ADMIN, PERSIST_RO_VARIABLES_ADMIN, PROCESS, RELOAD, REPLICATION CLIENT, REPLICATION_APPLIER, REPLICATION_SLAVE_ADMIN, ROLE_ADMIN, SELECT, SHUTDOWN, SYSTEM_VARIABLES_ADMIN ON *.* TO 'replication'@'%' WITH GRANT OPTION;
302+
EOSQL
303+
fi
304+
294305
"${mysql[@]}" <<-EOSQL
295306
-- What's done in this file shouldn't be replicated
296307
-- or products like mysql-fabric won't work
@@ -302,35 +313,29 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
302313
${rootCreate}
303314
/*!80016 REVOKE SYSTEM_USER ON *.* FROM root */;
304315
305-
CREATE USER 'operator'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${OPERATOR_ADMIN_PASSWORD}' ;
316+
CREATE USER 'operator'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${OPERATOR_ADMIN_PASSWORD}' PASSWORD EXPIRE NEVER;
306317
GRANT ALL ON *.* TO 'operator'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
307318
308-
CREATE USER 'xtrabackup'@'localhost' IDENTIFIED BY '${XTRABACKUP_PASSWORD}';
319+
CREATE USER 'xtrabackup'@'localhost' IDENTIFIED BY '${XTRABACKUP_PASSWORD}' PASSWORD EXPIRE NEVER;
309320
GRANT SYSTEM_USER, BACKUP_ADMIN, PROCESS, RELOAD, GROUP_REPLICATION_ADMIN, REPLICATION_SLAVE_ADMIN, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'xtrabackup'@'localhost';
310321
GRANT SELECT ON performance_schema.replication_group_members TO 'xtrabackup'@'localhost';
311322
GRANT SELECT ON performance_schema.log_status TO 'xtrabackup'@'localhost';
312323
GRANT SELECT ON performance_schema.keyring_component_status TO 'xtrabackup'@'localhost';
313324
314-
CREATE USER 'monitor'@'${MONITOR_HOST}' IDENTIFIED BY '${MONITOR_PASSWORD}' WITH MAX_USER_CONNECTIONS 100;
325+
CREATE USER 'monitor'@'${MONITOR_HOST}' IDENTIFIED BY '${MONITOR_PASSWORD}' WITH MAX_USER_CONNECTIONS 100 PASSWORD EXPIRE NEVER;
315326
GRANT SYSTEM_USER, SELECT, PROCESS, SUPER, REPLICATION CLIENT, RELOAD, BACKUP_ADMIN ON *.* TO 'monitor'@'${MONITOR_HOST}';
316327
GRANT SELECT ON performance_schema.* TO 'monitor'@'${MONITOR_HOST}';
317328
${monitorConnectGrant}
318329
319-
CREATE USER 'replication'@'%' IDENTIFIED BY '${REPLICATION_PASSWORD}';
320-
GRANT DELETE, INSERT, UPDATE ON mysql.* TO 'replication'@'%' WITH GRANT OPTION;
321-
GRANT SELECT ON performance_schema.threads to 'replication'@'%';
322-
GRANT SYSTEM_USER, REPLICATION SLAVE, BACKUP_ADMIN, GROUP_REPLICATION_STREAM, CLONE_ADMIN, CONNECTION_ADMIN, CREATE USER, EXECUTE, FILE, GROUP_REPLICATION_ADMIN, PERSIST_RO_VARIABLES_ADMIN, PROCESS, RELOAD, REPLICATION CLIENT, REPLICATION_APPLIER, REPLICATION_SLAVE_ADMIN, ROLE_ADMIN, SELECT, SHUTDOWN, SYSTEM_VARIABLES_ADMIN ON *.* TO 'replication'@'%' WITH GRANT OPTION;
323-
GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, INDEX, INSERT, LOCK TABLES, REFERENCES, SHOW VIEW, TRIGGER, UPDATE ON mysql_innodb_cluster_metadata.* TO 'replication'@'%' WITH GRANT OPTION;
324-
GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, INDEX, INSERT, LOCK TABLES, REFERENCES, SHOW VIEW, TRIGGER, UPDATE ON mysql_innodb_cluster_metadata_bkp.* TO 'replication'@'%' WITH GRANT OPTION;
325-
GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, INDEX, INSERT, LOCK TABLES, REFERENCES, SHOW VIEW, TRIGGER, UPDATE ON mysql_innodb_cluster_metadata_previous.* TO 'replication'@'%' WITH GRANT OPTION;
330+
${replicationCreate}
326331
327-
CREATE USER 'orchestrator'@'%' IDENTIFIED BY '${ORC_TOPOLOGY_PASSWORD}';
332+
CREATE USER 'orchestrator'@'%' IDENTIFIED BY '${ORC_TOPOLOGY_PASSWORD}' PASSWORD EXPIRE NEVER;
328333
GRANT SYSTEM_USER, SUPER, PROCESS, REPLICATION SLAVE, REPLICATION CLIENT, RELOAD ON *.* TO 'orchestrator'@'%';
329334
GRANT SELECT ON mysql.slave_master_info TO 'orchestrator'@'%';
330335
GRANT SELECT ON sys_operator.* TO 'orchestrator'@'%';
331336
332337
CREATE DATABASE IF NOT EXISTS sys_operator;
333-
CREATE USER 'heartbeat'@'localhost' IDENTIFIED BY '${HEARTBEAT_PASSWORD}';
338+
CREATE USER 'heartbeat'@'localhost' IDENTIFIED BY '${HEARTBEAT_PASSWORD}' PASSWORD EXPIRE NEVER;
334339
GRANT SYSTEM_USER, REPLICATION CLIENT ON *.* TO 'heartbeat'@'localhost';
335340
GRANT SELECT, CREATE, DELETE, UPDATE, INSERT ON sys_operator.heartbeat TO 'heartbeat'@'localhost';
336341

‎cmd/bootstrap/async_replication.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func bootstrapAsyncReplication(ctx context.Context) error {
8787
return errors.Wrapf(err, "get %s password", apiv1alpha1.UserOperator)
8888
}
8989

90-
db, err := replicator.NewReplicator(ctx, "operator", operatorPass, podIp, mysql.DefaultAdminPort)
90+
db, err := replicator.NewReplicator(ctx, apiv1alpha1.UserOperator, operatorPass, podIp, mysql.DefaultAdminPort)
9191
if err != nil {
9292
return errors.Wrap(err, "connect to db")
9393
}
@@ -142,7 +142,7 @@ func bootstrapAsyncReplication(ctx context.Context) error {
142142

143143
timer.Start("clone")
144144
log.Printf("Cloning from %s", donor)
145-
err = db.Clone(ctx, donor, "operator", operatorPass, mysql.DefaultAdminPort)
145+
err = db.Clone(ctx, donor, string(apiv1alpha1.UserOperator), operatorPass, mysql.DefaultAdminPort)
146146
timer.Stop("clone")
147147
if err != nil && !errors.Is(err, replicator.ErrRestartAfterClone) {
148148
return errors.Wrapf(err, "clone from donor %s", donor)
@@ -204,7 +204,7 @@ func getTopology(ctx context.Context, peers sets.Set[string]) (string, []string,
204204
}
205205

206206
for _, peer := range sets.List(peers) {
207-
db, err := replicator.NewReplicator(ctx, "operator", operatorPass, peer, mysql.DefaultAdminPort)
207+
db, err := replicator.NewReplicator(ctx, apiv1alpha1.UserOperator, operatorPass, peer, mysql.DefaultAdminPort)
208208
if err != nil {
209209
return "", nil, errors.Wrapf(err, "connect to %s", peer)
210210
}
@@ -251,7 +251,7 @@ func selectDonor(ctx context.Context, fqdn, primary string, replicas []string) (
251251
}
252252

253253
for _, replica := range replicas {
254-
db, err := replicator.NewReplicator(ctx, "operator", operatorPass, replica, mysql.DefaultAdminPort)
254+
db, err := replicator.NewReplicator(ctx, apiv1alpha1.UserOperator, operatorPass, replica, mysql.DefaultAdminPort)
255255
if err != nil {
256256
continue
257257
}

‎e2e-tests/run-distro.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ gr-init-deploy
88
gr-one-pod
99
gr-scaling
1010
gr-tls-cert-manager
11+
gr-users
1112
haproxy
1213
init-deploy
1314
monitoring

‎e2e-tests/run-minikube.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ gr-init-deploy
88
gr-one-pod
99
gr-scaling
1010
gr-tls-cert-manager
11+
gr-users
1112
haproxy
1213
init-deploy
1314
one-pod

‎e2e-tests/run-pr.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ gr-init-deploy
1111
gr-one-pod
1212
gr-scaling
1313
gr-tls-cert-manager
14+
gr-users
1415
haproxy
1516
init-deploy
1617
limits

‎e2e-tests/run-release.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ gr-init-deploy
1010
gr-one-pod
1111
gr-scaling
1212
gr-tls-cert-manager
13+
gr-users
1314
haproxy
1415
init-deploy
1516
limits

‎e2e-tests/tests/gr-users/00-assert.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 120
4+
---
5+
apiVersion: apiextensions.k8s.io/v1
6+
kind: CustomResourceDefinition
7+
metadata:
8+
name: perconaservermysqls.ps.percona.com
9+
spec:
10+
group: ps.percona.com
11+
names:
12+
kind: PerconaServerMySQL
13+
listKind: PerconaServerMySQLList
14+
plural: perconaservermysqls
15+
shortNames:
16+
- ps
17+
singular: perconaservermysql
18+
scope: Namespaced
19+
---
20+
apiVersion: apps/v1
21+
kind: Deployment
22+
metadata:
23+
name: percona-server-mysql-operator
24+
status:
25+
availableReplicas: 1
26+
observedGeneration: 1
27+
readyReplicas: 1
28+
replicas: 1
29+
updatedReplicas: 1
30+
---
31+
apiVersion: v1
32+
kind: Pod
33+
metadata:
34+
name: mysql-client

‎e2e-tests/tests/gr-users/00-deploy-operator.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
timeout: 10
4+
commands:
5+
- script: |-
6+
set -o errexit
7+
set -o xtrace
8+
9+
source ../../functions
10+
11+
deploy_operator
12+
deploy_non_tls_cluster_secrets
13+
deploy_tls_cluster_secrets
14+
deploy_client

‎e2e-tests/tests/gr-users/01-assert.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 420
4+
---
5+
apiVersion: apps/v1
6+
kind: StatefulSet
7+
metadata:
8+
generation: 1
9+
name: gr-users-mysql
10+
status:
11+
observedGeneration: 1
12+
replicas: 3
13+
readyReplicas: 3
14+
---
15+
apiVersion: apps/v1
16+
kind: Deployment
17+
metadata:
18+
generation: 1
19+
name: gr-users-router
20+
status:
21+
observedGeneration: 1
22+
readyReplicas: 3
23+
replicas: 3
24+
updatedReplicas: 3

0 commit comments

Comments
 (0)