MySQL Operator for Kubernetes

repository·trunk·Indexed 21 days ago

https://github.com/mysql/mysql-operator

An operator that automates the lifecycle management of MySQL InnoDB Clusters within Kubernetes, including setup, maintenance, automated upgrades, and backups. It supports installation via Helm and kubectl, provides tools for connecting via MySQL Shell or port forwarding, and includes a TLS Validation Proxy to verify client encryption modes.

Tokens
3K
Snippets
9
Records
15
Agent score
74%

What's inside mysql-operator

  1. Understand the constraints of MEB (MySQL Enterprise Backup) logic

    trunk

    The Enterprise Backup (MEB) logic is isolated and designed to be injected into the operator's workflow via a ConfigMap. When using MEB features, the logic is mounted into a Server container. Because of this deployment model, you must adhere to the following constraints:

    1. Dependency Constraint: The logic can only utilize Python dependencies that are already available within the Server container.
    2. Directory Structure Constraint: The logic must reside in a single, flat directory. The use of subdirectories is not supported.
  2. How the TLS Validation Proxy works

    trunk

    The TLS Validation Proxy acts as a transparent TCP proxy. It does not perform TLS termination. Instead, it inspects the client's TLS hello package to identify offered ciphers and validates them against a list of allowed ciphers.

    Because it does not terminate TLS, the certificate used by the actual destination server must be valid for the host the proxy is running on. When used with the MySQL Operator, the proxy is typically run in the same Pod as the operator, and the operator is configured to connect to 127.0.0.1, which is commonly included in server certificates.

  3. Install a MySQL InnoDB Cluster using kubectl

    trunk

    To deploy an InnoDB Cluster via kubectl, follow these steps:

    1. Create a credentials secret: Create a generic secret containing rootUser, rootHost, and rootPassword for administrative tasks.
    2. Define the InnoDBCluster resource: Create a YAML manifest of kind InnoDBCluster (API version mysql.oracle.com/v2) that references your secret.
    3. Apply the manifest: Use kubectl apply to trigger the operator to provision the cluster.

    The cluster will transition from PENDING to ONLINE status.

    # 1. Create secret
    $> kubectl create secret generic mypwds \
            --from-literal=rootUser=root \
            --from-literal=rootHost=% \
            --from-literal=rootPassword="sakila"
    
    # 2. Apply InnoDBCluster manifest (mycluster.yaml)
    $> kubectl apply -f mycluster.yaml
    
    # 3. Monitor status
    $> kubectl get innodbcluster --watch
  4. Install MySQL InnoDB Cluster using Helm

    trunk

    You can deploy a MySQL InnoDB Cluster using Helm. You can either use the default configuration or provide custom settings via the --set flag.

    Prerequisites:

    • Kubernetes 1.21+
    • Helm v3

    Default Installation: To install a cluster named mycluster using all default settings, run:

    helm install mycluster mysql-operator/mysql-innodbcluster

    Customized Installation: To customize the installation (e.g., setting credentials, namespace, and instance counts), use the --set flag. The following example installs the cluster in a specific namespace with custom root credentials and instance counts:

    helm install mycluster mysql-operator/mysql-innodbcluster \
            --namespace mynamespace \
            --create-namespace \
            --set credentials.root.user='root' \
            --set credentials.root.password='supersecret' \
            --set credentials.root.host='%' \
            --set serverInstances=3 \
            --set routerInstances=1
  5. Install a MySQL InnoDB Cluster using Helm

    trunk

    You can deploy an InnoDB Cluster using the mysql-operator/mysql-innodbcluster Helm chart. You can either use all defaults or provide custom configurations via --set flags.

    Common customization options include:

    • credentials.root.user
    • credentials.root.password
    • credentials.root.host
    • serverInstances
    • routerInstances
    # Install with defaults
    $> helm install mycluster mysql-operator/mysql-innodbcluster
    
    # Install with custom configuration
    $> helm install mycluster mysql-operator/mysql-innodbcluster \
            --namespace mynamespace \
            --create-namespace \
            --set credentials.root.user='root' \
            --set credentials.root.password='supersecret' \
            --set credentials.root.host='%' \
            --set serverInstances=3 \
            --set routerInstances=1
  6. Use the TLS Validation Proxy with MySQL Operator

    trunk

    The TLS Validation Proxy is a TCP proxy used to verify that TLS clients do not use weak encryption modes. It inspects the client's 'hello' package without performing TLS termination and then proxies the connection through.

    To use this with a default MySQL Operator installation (where kubectl is configured with the correct context), run the provided activation scripts from the tools/validate_tls_ciphers directory. This process creates a ConfigMap containing the proxy code and reconfigures the MySQL Operator Deployment to use it.

    Behavior Modes:

    • Default: Connections using an invalid cipher are interrupted. This is useful for identifying misconfigured clients via TLS errors.
    • Non-interrupting: Use the --no-abort flag to allow connections with invalid ciphers to proceed without interruption.
    # Activate the proxy (interrupts invalid ciphers)
    ./activate.sh
    
    # Activate the proxy (does NOT interrupt invalid ciphers)
    ./activate.sh --no-abort
    
    # Revert changes and remove the proxy
    ./deactivate.sh
  7. Install the MySQL Operator for Kubernetes with Helm

    trunk

    To install the MySQL Operator for Kubernetes, you must first add and update the official Helm repository, then deploy the operator using helm install. This installation deploys the latest version from DockerHub using default settings. You can customize the deployment using Helm options to override these defaults.

    Pre-requisites

    • Kubernetes 1.21+
    • Helm v3
    # Add and update the Helm repository
    helm repo add mysql-operator https://mysql.github.io/mysql-operator/
    helm repo update
    
    # Deploy the operator into the 'mysql-operator' namespace
    helm install mysql-operator mysql-operator/mysql-operator --namespace mysql-operator --create-namespace
  8. Install the MySQL Operator for Kubernetes using kubectl

    trunk

    To install the operator using manifest files, first apply the Custom Resource Definitions (CRDs) and then deploy the operator itself.

    1. Deploy CRDs: kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-crds.yaml
    2. Deploy the operator: kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-operator.yaml

    Verify the installation by checking the deployment in the mysql-operator namespace.

    $> kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-crds.yaml
    $> kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-operator.yaml
    $> kubectl get deployment -n mysql-operator mysql-operator
  9. Install the MySQL Operator for Kubernetes using Helm

    trunk

    You can use Helm to manage the operator installation. This method allows for customization via Helm options.

    1. Add and update the MySQL Operator Helm repository.
    2. Install the operator into the mysql-operator namespace.

    Note on Topology: In this release, operator topology is frozen after the initial startup. You must choose deployment.namespaces and deployment.standalone upfront. Changing these after bootstrap requires a full removal and reinstallation of the operator.

    $> helm repo add mysql-operator https://mysql.github.io/mysql-operator/
    $> helm repo update
    $> helm install mysql-operator mysql-operator/mysql-operator --namespace mysql-operator --create-namespace