VITESS User Management and Authentication for minikube
翁硕
User Management and Authentication 用户管理和认证
vitess通过VTGate有自己独特的方法管理用户和权限，因此，如果通过VTGate发送,create user和grant...语法将不会有效果。
mysql> create use chenhao identified by 'chenhao';
ERROR 1105 (HY000): vtgate: http://example-zone1-vtgate-bc6cde92-6cbc74fd8c-q75b5:15000/: syntax error at position 11 near 'use'
Vitess VTGate组件负责请求的身份验证，因此我们将需要通过命令行选项将应有权访问Keyspace的所有用户添加到VTGate。
官方方案（物理机方案）
配置用户的最简单方法是使用staticauth方法，我们可以以JSON格式的文件或字符串定义用户。
$ cat > users.json << EOF
{
"vitess": [
{
"UserData": "vitess",
"Password": "supersecretpassword"
}
],
"myuser1": [
{
"UserData": "myuser1",
"Password": "password1"
}
],
"myuser2": [
{
"UserData": "myuser2",
"Password": "password2"
}
]
}
EOF
使用其他命令行参数将其加载到VTGate中：
vtgate $(cat <<END_OF_COMMAND
-mysql_auth_server_impl=static
-mysql_auth_server_static_file=users.json
...
...
...
END_OF_COMMAND
)
vitess operator on kubernetes环境方案
找到vtgate所在pod，找到SecretName
kubectl get pod
NAME READY STATUS RESTARTS AGE
example-etcd-faf13de3-1 1/1 Running 1 21h
example-etcd-faf13de3-2 1/1 Running 0 21h
example-etcd-faf13de3-3 1/1 Running 0 21h
example-vttablet-zone1-2469782763-bfadd780 3/3 Running 1 21h
example-vttablet-zone1-2548885007-46a852d0 3/3 Running 1 21h
example-zone1-vtctld-1d4dcad0-c4586f7c8-n5nfq 1/1 Running 3 21h
example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn 1/1 Running 3 21h
vitess-operator-69b8854f64-xjmn2 1/1 Running 0 21h
kubectl describe pod example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn
Name: example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn
Namespace: default
Priority: 1000
Priority Class Name: vitess
Node: minikube/10.10.30.220
Start Time: Mon, 14 Dec 2020 17:29:18 +0800
Labels: planetscale.com/cell=zone1
planetscale.com/cluster=example
planetscale.com/component=vtgate
pod-template-hash=64bfdcfb57
Annotations: planetscale.com/secret-hash: af04fed47ed2a09bb59a670fe6fdb65c
Status: Running
IP: 172.17.0.5
IPs: <none>
Controlled By: ReplicaSet/example-zone1-vtgate-bc6cde92-64bfdcfb57
Containers:
vtgate:
Container ID: docker://86ca6d811b11666e076dececb0cf5371ceeb4f65816125dd968f26ac8a8fac4f
Image: vitess/lite:v6.0.20-20200429
Image ID: docker-pullable://vitess/lite@sha256:a74ba7fe9aa070ed471e9f17bcf7ba358f01bda87d52000e9ef2785f257105ec
Ports: 15000/TCP, 15999/TCP, 3306/TCP
Host Ports: 0/TCP, 0/TCP, 0/TCP
Command:
/vt/bin/vtgate
Args:
--buffer_max_failover_duration=10s
--buffer_min_time_between_failovers=20s
--cell=zone1
--cells_to_watch=zone1
--enable_buffer=true
--gateway_implementation=discoverygateway
--grpc_max_message_size=67108864
--grpc_port=15999
--logtostderr=true
--mysql_auth_server_impl=static
--mysql_auth_server_static_file=/vt/secrets/vtgate-static-auth/users.json
--mysql_server_port=3306
--port=15000
--service_map=grpc-vtgateservice
--tablet_types_to_wait=MASTER,REPLICA
--topo_global_root=/vitess/example/global
--topo_global_server_address=example-etcd-faf13de3-client:2379
--topo_implementation=etcd2
State: Running
Started: Mon, 14 Dec 2020 17:31:33 +0800
Last State: Terminated
Reason: Error
Exit Code: 1
Started: Mon, 14 Dec 2020 17:30:59 +0800
Finished: Mon, 14 Dec 2020 17:31:04 +0800
Ready: True
Restart Count: 3
Limits:
memory: 256Mi
Requests:
cpu: 100m
memory: 256Mi
Liveness: http-get http://:web/debug/status delay=300s timeout=1s period=10s #success=1 #failure=30
Readiness: http-get http://:web/debug/health delay=0s timeout=1s period=10s #success=1 #failure=3
Environment: <none>
Mounts: ######挂载位置
/var/run/secrets/kubernetes.io/serviceaccount from default-token-wv9ds (ro)
/vt/secrets/vtgate-static-auth from vtgate-static-auth-secret (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
vtgate-static-auth-secret:
Type: Secret (a volume populated by a Secret)
SecretName: example-cluster-config ####secretname名称
Optional: false
default-token-wv9ds:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-wv9ds
Optional: false
QoS Class: Burstable
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events: <none>
找到对应的users.json
kubectl get secret example-cluster-config -o yaml
kubectl get secret example-cluster-config -o yaml
apiVersion: v1
data:
init_db.sql: IyBUaGlzIGZpbGUgaXMgZXhlY3V0ZWQgaW1tZWRpYXRlbHkgYWZ0ZXIgbXlzcWxfaW5zdGFsbF9kYiwKIyB0byBpbml0aWFsaXplIGEgZnJlc2ggZGF0YSBkaXJlY3RvcnkuCgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgRXF1aXZhbGVudCBvZiBteXNxbF9zZWN1cmVfaW5zdGFsbGF0aW9uCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCiMgQ2hhbmdlcyBkdXJpbmcgdGhlIGluaXQgZGIgc2hvdWxkIG5vdCBtYWtlIGl0IHRvIHRoZSBiaW5sb2cuCiMgVGhleSBjb3VsZCBwb3RlbnRpYWxseSBjcmVhdGUgZXJyYW50IHRyYW5zYWN0aW9ucyBvbiByZXBsaWNhcy4KU0VUIHNxbF9sb2dfYmluID0gMDsKIyBSZW1vdmUgYW5vbnltb3VzIHVzZXJzLgpERUxFVEUgRlJPTSBteXNxbC51c2VyIFdIRVJFIFVzZXIgPSAnJzsKCiMgRGlzYWJsZSByZW1vdGUgcm9vdCBhY2Nlc3MgKG9ubHkgYWxsb3cgVU5JWCBzb2NrZXQpLgpERUxFVEUgRlJPTSBteXNxbC51c2VyIFdIRVJFIFVzZXIgPSAncm9vdCcgQU5EIEhvc3QgIT0gJ2xvY2FsaG9zdCc7CgojIFJlbW92ZSB0ZXN0IGRhdGFiYXNlLgpEUk9QIERBVEFCQVNFIElGIEVYSVNUUyB0ZXN0OwoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFZpdGVzcyBkZWZhdWx0cwojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojIFZpdGVzcy1pbnRlcm5hbCBkYXRhYmFzZS4KQ1JFQVRFIERBVEFCQVNFIElGIE5PVCBFWElTVFMgX3Z0OwojIE5vdGUgdGhhdCBkZWZpbml0aW9ucyBvZiBsb2NhbF9tZXRhZGF0YSBhbmQgc2hhcmRfbWV0YWRhdGEgc2hvdWxkIGJlIHRoZSBzYW1lCiMgYXMgaW4gcHJvZHVjdGlvbiB3aGljaCBpcyBkZWZpbmVkIGluIGdvL3Z0L215c3FsY3RsL21ldGFkYXRhX3RhYmxlcy5nby4KQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgX3Z0LmxvY2FsX21ldGFkYXRhICgKICBuYW1lIFZBUkNIQVIoMjU1KSBOT1QgTlVMTCwKICB2YWx1ZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwsCiAgZGJfbmFtZSBWQVJCSU5BUlkoMjU1KSBOT1QgTlVMTCwKICBQUklNQVJZIEtFWSAoZGJfbmFtZSwgbmFtZSkKICApIEVOR0lORT1Jbm5vREI7CkNSRUFURSBUQUJMRSBJRiBOT1QgRVhJU1RTIF92dC5zaGFyZF9tZXRhZGF0YSAoCiAgbmFtZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwsCiAgdmFsdWUgTUVESVVNQkxPQiBOT1QgTlVMTCwKICBkYl9uYW1lIFZBUkJJTkFSWSgyNTUpIE5PVCBOVUxMLAogIFBSSU1BUlkgS0VZIChkYl9uYW1lLCBuYW1lKQogICkgRU5HSU5FPUlubm9EQjsKCiMgQWRtaW4gdXNlciB3aXRoIGFsbCBwcml2aWxlZ2VzLgpDUkVBVEUgVVNFUiAndnRfZGJhJ0AnbG9jYWxob3N0JzsKR1JBTlQgQUxMIE9OICouKiBUTyAndnRfZGJhJ0AnbG9jYWxob3N0JzsKR1JBTlQgR1JBTlQgT1BUSU9OIE9OICouKiBUTyAndnRfZGJhJ0AnbG9jYWxob3N0JzsKCiMgVXNlciBmb3IgYXBwIHRyYWZmaWMsIHdpdGggZ2xvYmFsIHJlYWQtd3JpdGUgYWNjZXNzLgpDUkVBVEUgVVNFUiAndnRfYXBwJ0AnbG9jYWxob3N0JzsKR1JBTlQgU0VMRUNULCBJTlNFUlQsIFVQREFURSwgREVMRVRFLCBDUkVBVEUsIERST1AsIFJFTE9BRCwgUFJPQ0VTUywgRklMRSwKICBSRUZFUkVOQ0VTLCBJTkRFWCwgQUxURVIsIFNIT1cgREFUQUJBU0VTLCBDUkVBVEUgVEVNUE9SQVJZIFRBQkxFUywKICBMT0NLIFRBQkxFUywgRVhFQ1VURSwgUkVQTElDQVRJT04gU0xBVkUsIFJFUExJQ0FUSU9OIENMSUVOVCwgQ1JFQVRFIFZJRVcsCiAgU0hPVyBWSUVXLCBDUkVBVEUgUk9VVElORSwgQUxURVIgUk9VVElORSwgQ1JFQVRFIFVTRVIsIEVWRU5ULCBUUklHR0VSCiAgT04gKi4qIFRPICd2dF9hcHAnQCdsb2NhbGhvc3QnOwoKIyBVc2VyIGZvciBhcHAgZGVidWcgdHJhZmZpYywgd2l0aCBnbG9iYWwgcmVhZCBhY2Nlc3MuCkNSRUFURSBVU0VSICd2dF9hcHBkZWJ1ZydAJ2xvY2FsaG9zdCc7CkdSQU5UIFNFTEVDVCwgU0hPVyBEQVRBQkFTRVMsIFBST0NFU1MgT04gKi4qIFRPICd2dF9hcHBkZWJ1ZydAJ2xvY2FsaG9zdCc7CgojIFVzZXIgZm9yIGFkbWluaXN0cmF0aXZlIG9wZXJhdGlvbnMgdGhhdCBuZWVkIHRvIGJlIGV4ZWN1dGVkIGFzIG5vbi1TVVBFUi4KIyBTYW1lIHBlcm1pc3Npb25zIGFzIHZ0X2FwcCBoZXJlLgpDUkVBVEUgVVNFUiAndnRfYWxscHJpdnMnQCdsb2NhbGhvc3QnOwpHUkFOVCBTRUxFQ1QsIElOU0VSVCwgVVBEQVRFLCBERUxFVEUsIENSRUFURSwgRFJPUCwgUkVMT0FELCBQUk9DRVNTLCBGSUxFLAogIFJFRkVSRU5DRVMsIElOREVYLCBBTFRFUiwgU0hPVyBEQVRBQkFTRVMsIENSRUFURSBURU1QT1JBUlkgVEFCTEVTLAogIExPQ0sgVEFCTEVTLCBFWEVDVVRFLCBSRVBMSUNBVElPTiBTTEFWRSwgUkVQTElDQVRJT04gQ0xJRU5ULCBDUkVBVEUgVklFVywKICBTSE9XIFZJRVcsIENSRUFURSBST1VUSU5FLCBBTFRFUiBST1VUSU5FLCBDUkVBVEUgVVNFUiwgRVZFTlQsIFRSSUdHRVIKICBPTiAqLiogVE8gJ3Z0X2FsbHByaXZzJ0AnbG9jYWxob3N0JzsKCiMgVXNlciBmb3Igc2xhdmUgcmVwbGljYXRpb24gY29ubmVjdGlvbnMuCiMgVE9ETzogU2hvdWxkIHdlIHNldCBhIHBhc3N3b3JkIG9uIHRoaXMgc2luY2UgaXQgYWxsb3dzIHJlbW90ZSBjb25uZWN0aW9ucz8KQ1JFQVRFIFVTRVIgJ3Z0X3JlcGwnQCclJzsKR1JBTlQgUkVQTElDQVRJT04gU0xBVkUgT04gKi4qIFRPICd2dF9yZXBsJ0AnJSc7CgojIFVzZXIgZm9yIFZpdGVzcyBmaWx0ZXJlZCByZXBsaWNhdGlvbiAoYmlubG9nIHBsYXllcikuCiMgU2FtZSBwZXJtaXNzaW9ucyBhcyB2dF9hcHAuCkNSRUFURSBVU0VSICd2dF9maWx0ZXJlZCdAJ2xvY2FsaG9zdCc7CkdSQU5UIFNFTEVDVCwgSU5TRVJULCBVUERBVEUsIERFTEVURSwgQ1JFQVRFLCBEUk9QLCBSRUxPQUQsIFBST0NFU1MsIEZJTEUsCiAgUkVGRVJFTkNFUywgSU5ERVgsIEFMVEVSLCBTSE9XIERBVEFCQVNFUywgQ1JFQVRFIFRFTVBPUkFSWSBUQUJMRVMsCiAgTE9DSyBUQUJMRVMsIEVYRUNVVEUsIFJFUExJQ0FUSU9OIFNMQVZFLCBSRVBMSUNBVElPTiBDTElFTlQsIENSRUFURSBWSUVXLAogIFNIT1cgVklFVywgQ1JFQVRFIFJPVVRJTkUsIEFMVEVSIFJPVVRJTkUsIENSRUFURSBVU0VSLCBFVkVOVCwgVFJJR0dFUgogIE9OICouKiBUTyAndnRfZmlsdGVyZWQnQCdsb2NhbGhvc3QnOwoKIyBVc2VyIGZvciBPcmNoZXN0cmF0b3IgKGh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuYXJrL29yY2hlc3RyYXRvcikuCiMgVE9ETzogUmVlbmFibGUgd2hlbiB0aGUgcGFzc3dvcmQgaXMgcmFuZG9tbHkgZ2VuZXJhdGVkLgojQ1JFQVRFIFVTRVIgJ29yY19jbGllbnRfdXNlcidAJyUnIElERU5USUZJRUQgQlkgJ29yY19jbGllbnRfdXNlcl9wYXNzd29yZCc7CiNHUkFOVCBTVVBFUiwgUFJPQ0VTUywgUkVQTElDQVRJT04gU0xBVkUsIFJFTE9BRAojICBPTiAqLiogVE8gJ29yY19jbGllbnRfdXNlcidAJyUnOwojR1JBTlQgU0VMRUNUCiMgIE9OIF92dC4qIFRPICdvcmNfY2xpZW50X3VzZXInQCclJzsKCkZMVVNIIFBSSVZJTEVHRVM7CgpSRVNFVCBTTEFWRSBBTEw7ClJFU0VUIE1BU1RFUjsK
users.json: ewogICJ1c2VyIjogW3sKICAgICJVc2VyRGF0YSI6ICJ1c2VyIiwKICAgICJQYXNzd29yZCI6ICIiCiAgfV0KfQo=
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"example-cluster-config","namespace":"default"},"stringData":{"init_db.sql":"# This file is executed immediately after mysql_install_db,\n# to initialize a fresh data directory.\n\n###############################################################################\n# Equivalent of mysql_secure_installation\n###############################################################################\n\n# Changes during the init db should not make it to the binlog.\n# They could potentially create errant transactions on replicas.\nSET sql_log_bin = 0;\n# Remove anonymous users.\nDELETE FROM mysql.user WHERE User = '';\n\n# Disable remote root access (only allow UNIX socket).\nDELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';\n\n# Remove test database.\nDROP DATABASE IF EXISTS test;\n\n###############################################################################\n# Vitess defaults\n###############################################################################\n\n# Vitess-internal database.\nCREATE DATABASE IF NOT EXISTS _vt;\n# Note that definitions of local_metadata and shard_metadata should be the same\n# as in production which is defined in go/vt/mysqlctl/metadata_tables.go.\nCREATE TABLE IF NOT EXISTS _vt.local_metadata (\n name VARCHAR(255) NOT NULL,\n value VARCHAR(255) NOT NULL,\n db_name VARBINARY(255) NOT NULL,\n PRIMARY KEY (db_name, name)\n ) ENGINE=InnoDB;\nCREATE TABLE IF NOT EXISTS _vt.shard_metadata (\n name VARCHAR(255) NOT NULL,\n value MEDIUMBLOB NOT NULL,\n db_name VARBINARY(255) NOT NULL,\n PRIMARY KEY (db_name, name)\n ) ENGINE=InnoDB;\n\n# Admin user with all privileges.\nCREATE USER 'vt_dba'@'localhost';\nGRANT ALL ON *.* TO 'vt_dba'@'localhost';\nGRANT GRANT OPTION ON *.* TO 'vt_dba'@'localhost';\n\n# User for app traffic, with global read-write access.\nCREATE USER 'vt_app'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n ON *.* TO 'vt_app'@'localhost';\n\n# User for app debug traffic, with global read access.\nCREATE USER 'vt_appdebug'@'localhost';\nGRANT SELECT, SHOW DATABASES, PROCESS ON *.* TO 'vt_appdebug'@'localhost';\n\n# User for administrative operations that need to be executed as non-SUPER.\n# Same permissions as vt_app here.\nCREATE USER 'vt_allprivs'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n ON *.* TO 'vt_allprivs'@'localhost';\n\n# User for slave replication connections.\n# TODO: Should we set a password on this since it allows remote connections?\nCREATE USER 'vt_repl'@'%';\nGRANT REPLICATION SLAVE ON *.* TO 'vt_repl'@'%';\n\n# User for Vitess filtered replication (binlog player).\n# Same permissions as vt_app.\nCREATE USER 'vt_filtered'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n ON *.* TO 'vt_filtered'@'localhost';\n\n# User for Orchestrator (https://github.com/openark/orchestrator).\n# TODO: Reenable when the password is randomly generated.\n#CREATE USER 'orc_client_user'@'%' IDENTIFIED BY 'orc_client_user_password';\n#GRANT SUPER, PROCESS, REPLICATION SLAVE, RELOAD\n# ON *.* TO 'orc_client_user'@'%';\n#GRANT SELECT\n# ON _vt.* TO 'orc_client_user'@'%';\n\nFLUSH PRIVILEGES;\n\nRESET SLAVE ALL;\nRESET MASTER;\n","users.json":"{\n \"user\": [{\n \"UserData\": \"user\",\n \"Password\": \"\"\n }]\n}\n"},"type":"Opaque"}
creationTimestamp: "2020-12-14T09:29:18Z"
name: example-cluster-config
namespace: default
resourceVersion: "3277"
selfLink: /api/v1/namespaces/default/secrets/example-cluster-config
uid: 008b89b1-9531-43b7-9de9-4b74dde0620d
type: Opaque
拿到users.json，base64解码
echo "ewogICJ1c2VyIjogW3sKICAgICJVc2VyRGF0YSI6ICJ1c2VyIiwKICAgICJQYXNzd29yZCI6ICIiCiAgfV0KfQo=" |base64 -d
{
"user": [{
"UserData": "user",
"Password": ""
}]
}
制定自己要配置的用户密码文件
$ cat > myusers.json << EOF
{
"vitess": [
{
"UserData": "vitess",
"Password": "supersecretpassword"
}
],
"myuser1": [
{
"UserData": "myuser1",
"Password": "password1"
}
],
"myuser2": [
{
"UserData": "myuser2",
"Password": "password2"
}
]
}
EOF
加密用户密码文件
cat myusers.json |base64
ewogICJ1c2VyIjogWwp7CiAgICAiVXNlckRhdGEiOiAidXNlciIsCiAgICAiUGFzc3dvcmQiOiAiIgogIH0KXSwKICAidml0ZXNzIjogWwogICAgewogICAgICAiVXNlckRhdGEiOiAidml0ZXNzIiwKICAgICAgIlBhc3N3b3JkIjogInN1cGVyc2VjcmV0cGFzc3dvcmQiCiAgICB9CiAgXSwKICAibXl1c2VyMSI6IFsKICAgIHsKICAgICAgIlVzZXJEYXRhIjogIm15dXNlcjEiLAogICAgICAiUGFzc3dvcmQiOiAicGFzc3dvcmQxIgogICAgfQogIF0sCiAgIm15dXNlcjIiOiBbCiAgICB7CiAgICAgICJVc2VyRGF0YSI6ICJteXVzZXIyIiwKICAgICAgIlBhc3N3b3JkIjogInBhc3N3b3JkMiIKICAgIH0KICBdCn0=
验证
echo "ewogICJ1c2VyIjogWwp7CiAgICAiVXNlckRhdGEiOiAidXNlciIsCiAgICAiUGFzc3dvcmQiOiAiIgogIH0KXSwKICAidml0ZXNzIjogWwogICAgewogICAgICAiVXNlckRhdGEiOiAidml0ZXNzIiwKICAgICAgIlBhc3N3b3JkIjogInN1cGVyc2VjcmV0cGFzc3dvcmQiCiAgICB9CiAgXSwKICAibXl1c2VyMSI6IFsKICAgIHsKICAgICAgIlVzZXJEYXRhIjogIm15dXNlcjEiLAogICAgICAiUGFzc3dvcmQiOiAicGFzc3dvcmQxIgogICAgfQogIF0sCiAgIm15dXNlcjIiOiBbCiAgICB7CiAgICAgICJVc2VyRGF0YSI6ICJteXVzZXIyIiwKICAgICAgIlBhc3N3b3JkIjogInBhc3N3b3JkMiIKICAgIH0KICBdCn0=" |base64 -d
{
"user": [
{
"UserData": "user",
"Password": ""
}
],
"vitess": [
{
"UserData": "vitess",
"Password": "supersecretpassword"
}
],
"myuser1": [
{
"UserData": "myuser1",
"Password": "password1"
}
],
"myuser2": [
{
"UserData": "myuser2",
"Password": "password2"
}
]
}
修改example-cluster-config
kubectl edit secret example-cluster-config -o yaml
修改users.json
验证
mysql -h 10.97.122.40 -P 3306 -u myuser1 -ppassword1
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.7.9-Vitess MySQL Community Server (GPL)
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> quit
Bye
说明
vitess通过VTGate有自己独特的方法管理用户和权限，因此，如果通过VTGate发送,create user和grant...语法将不会有效果。
create user,grant...语法是对mysql用户使用的命令
VTGate始终用以下用户跟mysql沟通
mysql> select user,host from mysql.user;
+---------------+-----------+
| user | host |
+---------------+-----------+
| vt_repl | % |
| mysql.session | localhost |
| mysql.sys | localhost |
| root | localhost |
| vt_allprivs | localhost |
| vt_app | localhost |
| vt_appdebug | localhost |
| vt_dba | localhost |
| vt_filtered | localhost |
+---------------+-----------+
9 rows in set (0.01 sec)
类似资料：