Skip to content

Commit bd3031b

Browse files
egegunesegegunes
committed
Merge branch 'main' into K8SPS-335
2 parents 8a263b9 + 076a985 commit bd3031b

File tree

135 files changed

+2274
-411
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

135 files changed

+2274
-411
lines changed

‎Jenkinsfile

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,7 @@ pipeline {
375375
ENABLE_LOGGING = "true"
376376
}
377377
agent {
378-
label 'docker'
378+
label 'docker-x64-min'
379379
}
380380
options {
381381
disableConcurrentBuilds(abortPrevious: true)
@@ -530,7 +530,7 @@ pipeline {
530530
}
531531
}
532532
agent {
533-
label 'docker'
533+
label 'docker-x64-min'
534534
}
535535
steps {
536536
prepareNode()
@@ -545,7 +545,7 @@ pipeline {
545545
}
546546
}
547547
agent {
548-
label 'docker'
548+
label 'docker-x64-min'
549549
}
550550
steps {
551551
prepareNode()
@@ -560,7 +560,7 @@ pipeline {
560560
}
561561
}
562562
agent {
563-
label 'docker'
563+
label 'docker-x64-min'
564564
}
565565
steps {
566566
prepareNode()
@@ -575,7 +575,7 @@ pipeline {
575575
}
576576
}
577577
agent {
578-
label 'docker'
578+
label 'docker-x64-min'
579579
}
580580
steps {
581581
prepareNode()
@@ -590,7 +590,7 @@ pipeline {
590590
}
591591
}
592592
agent {
593-
label 'docker'
593+
label 'docker-x64-min'
594594
}
595595
steps {
596596
prepareNode()
@@ -605,7 +605,7 @@ pipeline {
605605
}
606606
}
607607
agent {
608-
label 'docker'
608+
label 'docker-x64-min'
609609
}
610610
steps {
611611
prepareNode()
@@ -620,7 +620,7 @@ pipeline {
620620
}
621621
}
622622
agent {
623-
label 'docker'
623+
label 'docker-x64-min'
624624
}
625625
steps {
626626
prepareNode()

‎Makefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -275,11 +275,11 @@ after-release: manifests
275275
echo $(NEXT_VER) > pkg/version/version.txt
276276
$(SED) -i \
277277
-e "/^spec:/,/^ crVersion:/{s/crVersion: .*/crVersion: $(NEXT_VER)/}" \
278-
-e "/^ mysql:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-psmysql#}" \
278+
-e "/^ mysql:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-psmysql8.0#}" \
279279
-e "/^ haproxy:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-haproxy#}" \
280-
-e "/^ router:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-router#}" \
280+
-e "/^ router:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-router8.0#}" \
281281
-e "/^ orchestrator:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-orchestrator#}" \
282-
-e "/^ backup:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-backup#}" \
282+
-e "/^ backup:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-backup8.0#}" \
283283
-e "/^ toolkit:/,/^ image:/{s#image: .*#image: perconalab/percona-server-mysql-operator:main-toolkit#}" \
284284
-e "s#initImage: .*#initImage: perconalab/percona-server-mysql-operator:main#g" \
285285
-e "/^ pmm:/,/^ image:/{s#image: .*#image: perconalab/pmm-client:3-dev-latest#}" \

‎api/v1alpha1/perconaservermysql_types.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,8 @@ type MySQLSpec struct {
128128
SidecarVolumes []corev1.Volume `json:"sidecarVolumes,omitempty"`
129129
SidecarPVCs []SidecarPVC `json:"sidecarPVCs,omitempty"`
130130

131+
VaultSecretName string `json:"vaultSecretName,omitempty"`
132+
131133
PodSpec `json:",inline"`
132134
}
133135

@@ -415,6 +417,8 @@ type MySQLRouterSpec struct {
415417

416418
Expose ServiceExpose `json:"expose,omitempty"`
417419

420+
Ports []corev1.ServicePort `json:"ports,omitempty"`
421+
418422
PodSpec `json:",inline"`
419423
}
420424

@@ -590,6 +594,16 @@ func (cr *PerconaServerMySQL) SetVersion() {
590594
cr.Spec.CRVersion = version.Version()
591595
}
592596

597+
func (cr *PerconaServerMySQL) Version() *v.Version {
598+
return v.Must(v.NewVersion(cr.Spec.CRVersion))
599+
}
600+
601+
// CompareVersion compares given version to current version.
602+
// Returns -1, 0, or 1 if given version is smaller, equal, or larger than the current version, respectively.
603+
func (cr *PerconaServerMySQL) CompareVersion(ver string) int {
604+
return cr.Version().Compare(v.Must(v.NewVersion(ver)))
605+
}
606+
593607
// CheckNSetDefaults validates and sets default values for the PerconaServerMySQL custom resource.
594608
func (cr *PerconaServerMySQL) CheckNSetDefaults(_ context.Context, serverVersion *platform.ServerVersion) error {
595609
if len(cr.Spec.MySQL.ClusterType) == 0 {
@@ -880,6 +894,10 @@ func (cr *PerconaServerMySQL) CheckNSetDefaults(_ context.Context, serverVersion
880894
cr.Spec.SSLSecretName = cr.Name + "-ssl"
881895
}
882896

897+
if cr.Spec.MySQL.VaultSecretName == "" {
898+
cr.Spec.MySQL.VaultSecretName = cr.Name + "-vault"
899+
}
900+
883901
return nil
884902
}
885903

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎build/orc-entrypoint.sh

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,15 @@ fi
4343

4444
set +o xtrace
4545
temp=$(mktemp)
46-
sed -r "s|^[#]?user=.*$|user=${TOPOLOGY_USER}|" "${ORC_CONF_PATH}/orc-topology.cnf" >"${temp}"
47-
sed -r "s|^[#]?password=.*$|password=${TOPOLOGY_PASSWORD:-$ORC_TOPOLOGY_PASSWORD}|" "${ORC_CONF_PATH}/orc-topology.cnf" >"${temp}"
46+
47+
ESCAPED_PASSWORD=$(printf '%s' "${TOPOLOGY_PASSWORD:-$ORC_TOPOLOGY_PASSWORD}" | sed -e 's/[&"\\]/\\&/g')
48+
ESCAPED_PASSWORD="\"${ESCAPED_PASSWORD}\"" # Wrap in double quotes for .cnf
49+
50+
sed -r \
51+
-e "s|^[#]?user=.*$|user=${TOPOLOGY_USER}|" \
52+
-e "s|^[#]?password=.*$|password=${ESCAPED_PASSWORD}|" \
53+
"${ORC_CONF_PATH}/orc-topology.cnf" > "${temp}"
54+
4855
cat "${temp}" >"${ORC_CONF_PATH}/config/orc-topology.cnf"
4956
rm "${temp}"
5057
set -o xtrace

‎build/ps-entrypoint.sh

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,26 @@ create_default_cnf() {
167167
sed -i "/\[mysqld\]/a ssl_key=${TLS_DIR}/tls.key" $CFG
168168
fi
169169

170+
# if vault secret file exists we assume we need to turn on encryption
171+
vault_secret="/etc/mysql/vault-keyring-secret/keyring_vault.conf"
172+
if [[ -f "${vault_secret}" ]]; then
173+
sed -i "/\[mysqld\]/a early-plugin-load=keyring_vault.so" $CFG
174+
sed -i "/\[mysqld\]/a keyring_vault_config=${vault_secret}" $CFG
175+
176+
if [[ ${MYSQL_VERSION} =~ ^(8\.0|8\.4)$ ]]; then
177+
sed -i "/\[mysqld\]/a default_table_encryption=ON" $CFG
178+
sed -i "/\[mysqld\]/a table_encryption_privilege_check=ON" $CFG
179+
sed -i "/\[mysqld\]/a innodb_undo_log_encrypt=ON" $CFG
180+
sed -i "/\[mysqld\]/a innodb_redo_log_encrypt=ON" $CFG
181+
sed -i "/\[mysqld\]/a binlog_encryption=ON" $CFG
182+
sed -i "/\[mysqld\]/a binlog_rotate_encryption_master_key_at_startup=ON" $CFG
183+
sed -i "/\[mysqld\]/a innodb_temp_tablespace_encrypt=ON" $CFG
184+
sed -i "/\[mysqld\]/a innodb_parallel_dblwr_encrypt=ON" $CFG
185+
sed -i "/\[mysqld\]/a innodb_encrypt_online_alter_logs=ON" $CFG
186+
sed -i "/\[mysqld\]/a encrypt_tmp_files=ON" $CFG
187+
fi
188+
fi
189+
170190
for f in "${CUSTOM_CONFIG_FILES[@]}"; do
171191
echo "${f}"
172192
if [ -f "${f}" ]; then
@@ -190,6 +210,14 @@ ensure_read_only() {
190210
sed -i "/\[mysqld\]/a super_read_only=ON" $CFG
191211
}
192212

213+
escape_special() {
214+
{ set +x; } 2>/dev/null
215+
echo "$1" \
216+
| sed 's/\\/\\\\/g' \
217+
| sed 's/'\''/'\\\\\''/g' \
218+
| sed 's/"/\\\"/g'
219+
}
220+
193221
MYSQL_VERSION=$(mysqld -V | awk '{print $3}' | awk -F'.' '{print $1"."$2}')
194222

195223
if [[ "$MYSQL_VERSION" != '8.0' ]] && [[ "${MYSQL_VERSION}" != '8.4' ]]; then
@@ -275,7 +303,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
275303
# no, we don't care if read finds a terminating character in this heredoc
276304
# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
277305
read -r -d '' rootCreate <<-EOSQL || true
278-
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' PASSWORD EXPIRE NEVER;
306+
CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '$(escape_special "${MYSQL_ROOT_PASSWORD}")' PASSWORD EXPIRE NEVER;
279307
GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
280308
EOSQL
281309
fi
@@ -299,38 +327,38 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
299327
SET @@SESSION.SQL_LOG_BIN=0;
300328
301329
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root', 'mysql.infoschema', 'mysql.session') OR host NOT IN ('localhost') ;
302-
ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
330+
ALTER USER 'root'@'localhost' IDENTIFIED BY '$(escape_special "${MYSQL_ROOT_PASSWORD}")' ;
303331
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
304332
${rootCreate}
305333
/*!80016 REVOKE SYSTEM_USER ON *.* FROM root */;
306334
307-
CREATE USER 'operator'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${OPERATOR_ADMIN_PASSWORD}' PASSWORD EXPIRE NEVER;
335+
CREATE USER 'operator'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '$(escape_special "${OPERATOR_ADMIN_PASSWORD}")' PASSWORD EXPIRE NEVER;
308336
GRANT ALL ON *.* TO 'operator'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
309337
310-
CREATE USER 'xtrabackup'@'localhost' IDENTIFIED BY '${XTRABACKUP_PASSWORD}' PASSWORD EXPIRE NEVER;
338+
CREATE USER 'xtrabackup'@'localhost' IDENTIFIED BY '$(escape_special "${XTRABACKUP_PASSWORD}")' PASSWORD EXPIRE NEVER;
311339
GRANT SYSTEM_USER, BACKUP_ADMIN, PROCESS, RELOAD, GROUP_REPLICATION_ADMIN, REPLICATION_SLAVE_ADMIN, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'xtrabackup'@'localhost';
312340
GRANT SELECT ON performance_schema.replication_group_members TO 'xtrabackup'@'localhost';
313341
GRANT SELECT ON performance_schema.log_status TO 'xtrabackup'@'localhost';
314342
GRANT SELECT ON performance_schema.keyring_component_status TO 'xtrabackup'@'localhost';
315343
316-
CREATE USER 'monitor'@'${MONITOR_HOST}' IDENTIFIED BY '${MONITOR_PASSWORD}' WITH MAX_USER_CONNECTIONS 100 PASSWORD EXPIRE NEVER;
344+
CREATE USER 'monitor'@'${MONITOR_HOST}' IDENTIFIED BY '$(escape_special "${MONITOR_PASSWORD}")' WITH MAX_USER_CONNECTIONS 100 PASSWORD EXPIRE NEVER;
317345
GRANT SYSTEM_USER, SELECT, PROCESS, SUPER, REPLICATION CLIENT, RELOAD, BACKUP_ADMIN ON *.* TO 'monitor'@'${MONITOR_HOST}';
318346
GRANT SELECT ON performance_schema.* TO 'monitor'@'${MONITOR_HOST}';
319347
${monitorConnectGrant}
320348
321-
CREATE USER 'replication'@'%' IDENTIFIED BY '${REPLICATION_PASSWORD}' PASSWORD EXPIRE NEVER;
349+
CREATE USER 'replication'@'%' IDENTIFIED BY '$(escape_special "${REPLICATION_PASSWORD}")' PASSWORD EXPIRE NEVER;
322350
GRANT DELETE, INSERT, UPDATE ON mysql.* TO 'replication'@'%' WITH GRANT OPTION;
323351
GRANT SELECT ON performance_schema.threads to 'replication'@'%';
324352
GRANT SYSTEM_USER, REPLICATION SLAVE, BACKUP_ADMIN, GROUP_REPLICATION_STREAM, CLONE_ADMIN, CONNECTION_ADMIN, CREATE USER, EXECUTE, FILE, GROUP_REPLICATION_ADMIN, PERSIST_RO_VARIABLES_ADMIN, PROCESS, RELOAD, REPLICATION CLIENT, REPLICATION_APPLIER, REPLICATION_SLAVE_ADMIN, ROLE_ADMIN, SELECT, SHUTDOWN, SYSTEM_VARIABLES_ADMIN ON *.* TO 'replication'@'%' WITH GRANT OPTION;
325353
326-
CREATE USER 'orchestrator'@'%' IDENTIFIED BY '${ORC_TOPOLOGY_PASSWORD}' PASSWORD EXPIRE NEVER;
354+
CREATE USER 'orchestrator'@'%' IDENTIFIED BY '$(escape_special "${ORC_TOPOLOGY_PASSWORD}")' PASSWORD EXPIRE NEVER;
327355
GRANT SYSTEM_USER, SUPER, PROCESS, REPLICATION SLAVE, REPLICATION CLIENT, RELOAD ON *.* TO 'orchestrator'@'%';
328356
GRANT SELECT ON performance_schema.replication_group_members TO 'orchestrator'@'%';
329357
GRANT SELECT ON mysql.slave_master_info TO 'orchestrator'@'%';
330358
GRANT SELECT ON sys_operator.* TO 'orchestrator'@'%';
331359
332360
CREATE DATABASE IF NOT EXISTS sys_operator;
333-
CREATE USER 'heartbeat'@'localhost' IDENTIFIED BY '${HEARTBEAT_PASSWORD}' PASSWORD EXPIRE NEVER;
361+
CREATE USER 'heartbeat'@'localhost' IDENTIFIED BY '$(escape_special "${HEARTBEAT_PASSWORD}")' PASSWORD EXPIRE NEVER;
334362
GRANT SYSTEM_USER, REPLICATION CLIENT ON *.* TO 'heartbeat'@'localhost';
335363
GRANT SELECT, CREATE, DELETE, UPDATE, INSERT ON sys_operator.heartbeat TO 'heartbeat'@'localhost';
336364

‎build/ps-pre-stop.sh

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,13 @@ fi
88

99
LOG_FILE=/var/lib/mysql/pre-stop.log
1010
NAMESPACE=$(</var/run/secrets/kubernetes.io/serviceaccount/namespace)
11-
OPERATOR_PASSWORD=$(</etc/mysql/mysql-users-secret/operator)
11+
OPERATOR_PASSWORD=$(perl -MURI::Escape -e 'print uri_escape($ARGV[0]);' "$(</etc/mysql/mysql-users-secret/operator)")
1212
FQDN="${HOSTNAME}.${SERVICE_NAME}.${NAMESPACE}"
1313
POD_IP=$(hostname -I | awk '{print $1}')
1414

1515
echo "$(date +%Y-%m-%dT%H:%M:%S%Z): Removing ${FQDN} from cluster" >>${LOG_FILE}
16-
mysqlsh --js -i -h "${POD_IP}" -P 33062 -u operator -p"${OPERATOR_PASSWORD}" -e "dba.getCluster().removeInstance('${FQDN}:3306')" >>${LOG_FILE} 2>&1
16+
17+
mysqlsh --js -i \
18+
-h "${POD_IP}" -P 33062 \
19+
-u operator -p"${OPERATOR_PASSWORD}" \
20+
-e "dba.getCluster().removeInstance('${FQDN}:3306')" >>${LOG_FILE} 2>&1

‎build/router-entrypoint.sh

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,23 @@ ROUTER_DIR=${ROUTER_DIR:-/tmp/router}
66
OPERATOR_USER=${OPERATOR_USER:-operator}
77
NAMESPACE=$(</var/run/secrets/kubernetes.io/serviceaccount/namespace)
88

9+
urlencode() {
10+
python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1]))' "$1"
11+
}
12+
913
if [ -f "/etc/mysql/mysql-users-secret/${OPERATOR_USER}" ]; then
1014
OPERATOR_PASS=$(<"/etc/mysql/mysql-users-secret/${OPERATOR_USER}")
15+
OPERATOR_PASS_ESCAPED=$(urlencode "$OPERATOR_PASS")
1116
fi
1217

1318
mysqlrouter --force \
14-
--bootstrap "${OPERATOR_USER}:${OPERATOR_PASS}@${MYSQL_SERVICE_NAME}-0.${MYSQL_SERVICE_NAME}.${NAMESPACE}.svc" \
19+
--bootstrap "${OPERATOR_USER}:${OPERATOR_PASS_ESCAPED}@${MYSQL_SERVICE_NAME}-0.${MYSQL_SERVICE_NAME}.${NAMESPACE}.svc" \
1520
--conf-bind-address 0.0.0.0 \
1621
--conf-set-option http_auth_backend:default_auth_backend.backend=file \
1722
--conf-set-option http_auth_backend:default_auth_backend.filename="${ROUTER_DIR}/realm.txt" \
1823
--directory "${ROUTER_DIR}"
1924

20-
echo ${OPERATOR_PASS} | mysqlrouter_passwd set "${ROUTER_DIR}/realm.txt" ${OPERATOR_USER}
25+
echo "${OPERATOR_PASS_ESCAPED}" | mysqlrouter_passwd set "${ROUTER_DIR}/realm.txt" "${OPERATOR_USER}"
2126

2227
sed -i 's/logging_folder=.*/logging_folder=/g' "${ROUTER_DIR}/mysqlrouter.conf"
2328
sed -i "/\[logger\]/a destination=/dev/stdout" "${ROUTER_DIR}/mysqlrouter.conf"

‎build/router_readiness_check.sh

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,20 @@
11
#!/bin/bash
22

3+
urlencode() {
4+
python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1]))' "$1"
5+
}
6+
37
OPERATOR_PASS=$(</etc/mysql/mysql-users-secret/operator)
8+
OPERATOR_PASS_ESCAPED=$(urlencode "$OPERATOR_PASS")
49

5-
if ! curl -k -s -u operator:"${OPERATOR_PASS}" https://localhost:8443/api/20190715/routes/bootstrap_rw/health | grep true; then
10+
if ! curl -k -s -u operator:"${OPERATOR_PASS_ESCAPED}" https://localhost:8443/api/20190715/routes/bootstrap_rw/health | grep true; then
611
echo "Read-write route is not healthy"
712
exit 1
813
fi
914

10-
if ! curl -k -s -u operator:"${OPERATOR_PASS}" https://localhost:8443/api/20190715/routes/bootstrap_ro/health | grep true; then
15+
if ! curl -k -s -u operator:"${OPERATOR_PASS_ESCAPED}" https://localhost:8443/api/20190715/routes/bootstrap_ro/health | grep true; then
1116
echo "Read-only route is not healthy"
1217
exit 1
1318
fi
1419

15-
exit 0
20+
exit 0

‎build/router_startup_check.sh

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
#!/bin/bash
22

3+
urlencode() {
4+
python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1]))' "$1"
5+
}
6+
37
OPERATOR_PASS=$(</etc/mysql/mysql-users-secret/operator)
8+
OPERATOR_PASS_ESCAPED=$(urlencode "$OPERATOR_PASS")
49

5-
if [[ $(curl -k -s -u operator:"${OPERATOR_PASS}" -o /dev/null -w %{http_code} https://localhost:8443/api/20190715/router/status) != 200 ]]; then
10+
if [[ $(curl -k -s -u operator:"${OPERATOR_PASS_ESCAPED}" -o /dev/null -w %{http_code} https://localhost:8443/api/20190715/router/status) != 200 ]]; then
611
echo "Router is not ready"
7-
fi
12+
fi

0 commit comments

Comments
 (0)