MySQL Operator for Kubernetes
repository·trunk·Indexed 21 days ago
https://github.com/mysql/mysql-operatorAn operator that automates the lifecycle management of MySQL InnoDB Clusters within Kubernetes, including setup, maintenance, automated upgrades, and backups. It supports installation via Helm and kubectl, provides tools for connecting via MySQL Shell or port forwarding, and includes a TLS Validation Proxy to verify client encryption modes.
What's inside mysql-operator
- The MySQL Operator for Kubernetes is an operator designed to manage MySQL InnoDB Cluster setups within a Kubernetes cluster. It automates the full lifecycle of the database, including setup, maintenance, automated upgrades, and backups.
Overview of MySQL Operator for Kubernetes
trunkThe MySQL Operator for Kubernetes is designed to manage the full lifecycle of MySQL InnoDB Cluster setups within a Kubernetes cluster. It automates key operational tasks including:
- Initial setup of InnoDB Clusters
- Ongoing maintenance
- Automated upgrades
- Automated backups
Understand the constraints of MEB (MySQL Enterprise Backup) logic
trunkThe Enterprise Backup (MEB) logic is isolated and designed to be injected into the operator's workflow via a ConfigMap. When using MEB features, the logic is mounted into a Server container. Because of this deployment model, you must adhere to the following constraints:
- Dependency Constraint: The logic can only utilize Python dependencies that are already available within the Server container.
- Directory Structure Constraint: The logic must reside in a single, flat directory. The use of subdirectories is not supported.
How the TLS Validation Proxy works
trunkThe TLS Validation Proxy acts as a transparent TCP proxy. It does not perform TLS termination. Instead, it inspects the client's TLS hello package to identify offered ciphers and validates them against a list of allowed ciphers.
Because it does not terminate TLS, the certificate used by the actual destination server must be valid for the host the proxy is running on. When used with the MySQL Operator, the proxy is typically run in the same Pod as the operator, and the operator is configured to connect to
127.0.0.1, which is commonly included in server certificates.Install a MySQL InnoDB Cluster using kubectl
trunkTo deploy an InnoDB Cluster via
kubectl, follow these steps:- Create a credentials secret: Create a generic secret containing
rootUser,rootHost, androotPasswordfor administrative tasks. - Define the InnoDBCluster resource: Create a YAML manifest of kind
InnoDBCluster(API versionmysql.oracle.com/v2) that references your secret. - Apply the manifest: Use
kubectl applyto trigger the operator to provision the cluster.
The cluster will transition from
PENDINGtoONLINEstatus.# 1. Create secret $> kubectl create secret generic mypwds \ --from-literal=rootUser=root \ --from-literal=rootHost=% \ --from-literal=rootPassword="sakila" # 2. Apply InnoDBCluster manifest (mycluster.yaml) $> kubectl apply -f mycluster.yaml # 3. Monitor status $> kubectl get innodbcluster --watch- Create a credentials secret: Create a generic secret containing
Install MySQL InnoDB Cluster using Helm
trunkYou can deploy a MySQL InnoDB Cluster using Helm. You can either use the default configuration or provide custom settings via the
--setflag.Prerequisites:
- Kubernetes 1.21+
- Helm v3
Default Installation: To install a cluster named
myclusterusing all default settings, run:helm install mycluster mysql-operator/mysql-innodbclusterCustomized Installation: To customize the installation (e.g., setting credentials, namespace, and instance counts), use the
--setflag. The following example installs the cluster in a specific namespace with custom root credentials and instance counts:helm install mycluster mysql-operator/mysql-innodbcluster \ --namespace mynamespace \ --create-namespace \ --set credentials.root.user='root' \ --set credentials.root.password='supersecret' \ --set credentials.root.host='%' \ --set serverInstances=3 \ --set routerInstances=1Install a MySQL InnoDB Cluster using Helm
trunkYou can deploy an InnoDB Cluster using the
mysql-operator/mysql-innodbclusterHelm chart. You can either use all defaults or provide custom configurations via--setflags.Common customization options include:
credentials.root.usercredentials.root.passwordcredentials.root.hostserverInstancesrouterInstances
# Install with defaults $> helm install mycluster mysql-operator/mysql-innodbcluster # Install with custom configuration $> helm install mycluster mysql-operator/mysql-innodbcluster \ --namespace mynamespace \ --create-namespace \ --set credentials.root.user='root' \ --set credentials.root.password='supersecret' \ --set credentials.root.host='%' \ --set serverInstances=3 \ --set routerInstances=1Use the TLS Validation Proxy with MySQL Operator
trunkThe TLS Validation Proxy is a TCP proxy used to verify that TLS clients do not use weak encryption modes. It inspects the client's 'hello' package without performing TLS termination and then proxies the connection through.
To use this with a default MySQL Operator installation (where
kubectlis configured with the correct context), run the provided activation scripts from thetools/validate_tls_ciphersdirectory. This process creates a ConfigMap containing the proxy code and reconfigures the MySQL Operator Deployment to use it.Behavior Modes:
- Default: Connections using an invalid cipher are interrupted. This is useful for identifying misconfigured clients via TLS errors.
- Non-interrupting: Use the
--no-abortflag to allow connections with invalid ciphers to proceed without interruption.
# Activate the proxy (interrupts invalid ciphers) ./activate.sh # Activate the proxy (does NOT interrupt invalid ciphers) ./activate.sh --no-abort # Revert changes and remove the proxy ./deactivate.shPre-requisites for MySQL Operator for Kubernetes
trunkBefore installing the MySQL Operator for Kubernetes, ensure your environment meets the following requirements:
- Kubernetes version 1.21 or higher
- Helm version 3 or higher
Install the MySQL Operator for Kubernetes with Helm
trunkTo install the MySQL Operator for Kubernetes, you must first add and update the official Helm repository, then deploy the operator using
helm install. This installation deploys the latest version from DockerHub using default settings. You can customize the deployment using Helm options to override these defaults.Pre-requisites
- Kubernetes 1.21+
- Helm v3
# Add and update the Helm repository helm repo add mysql-operator https://mysql.github.io/mysql-operator/ helm repo update # Deploy the operator into the 'mysql-operator' namespace helm install mysql-operator mysql-operator/mysql-operator --namespace mysql-operator --create-namespaceInstall the MySQL Operator for Kubernetes using kubectl
trunkTo install the operator using manifest files, first apply the Custom Resource Definitions (CRDs) and then deploy the operator itself.
- Deploy CRDs:
kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-crds.yaml - Deploy the operator:
kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-operator.yaml
Verify the installation by checking the deployment in the
mysql-operatornamespace.$> kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-crds.yaml $> kubectl apply -f https://raw.githubusercontent.com/mysql/mysql-operator/26.7.0-2.3.0/deploy/deploy-operator.yaml $> kubectl get deployment -n mysql-operator mysql-operator- Deploy CRDs:
Install the MySQL Operator for Kubernetes using Helm
trunkYou can use Helm to manage the operator installation. This method allows for customization via Helm options.
- Add and update the MySQL Operator Helm repository.
- Install the operator into the
mysql-operatornamespace.
Note on Topology: In this release, operator topology is frozen after the initial startup. You must choose
deployment.namespacesanddeployment.standaloneupfront. Changing these after bootstrap requires a full removal and reinstallation of the operator.$> helm repo add mysql-operator https://mysql.github.io/mysql-operator/ $> helm repo update $> helm install mysql-operator mysql-operator/mysql-operator --namespace mysql-operator --create-namespace