VITESS User Management and Authentication for minikube

最新推荐文章于 2022-09-12 14:36:32 发布

陈同学别秀了

最新推荐文章于 2022-09-12 14:36:32 发布

阅读量979

点赞数

分类专栏： k8s vitess mysql

本文链接：https://blog.csdn.net/qq_39570637/article/details/111239660

版权

mysql 同时被 3 个专栏收录

15 篇文章 0 订阅

订阅专栏

k8s

4 篇文章 0 订阅

订阅专栏

vitess

3 篇文章 0 订阅

订阅专栏

User Management and Authentication 用户管理和认证

vitess通过VTGate有自己独特的方法管理用户和权限，因此，如果通过VTGate发送,create user和grant...语法将不会有效果。

mysql> create use chenhao identified by 'chenhao';
ERROR 1105 (HY000): vtgate: http://example-zone1-vtgate-bc6cde92-6cbc74fd8c-q75b5:15000/: syntax error at position 11 near 'use'

Vitess VTGate组件负责请求的身份验证，因此我们将需要通过命令行选项将应有权访问Keyspace的所有用户添加到VTGate。

官方方案（物理机方案）

配置用户的最简单方法是使用staticauth方法，我们可以以JSON格式的文件或字符串定义用户。

$ cat > users.json << EOF
{
  "vitess": [
    {
      "UserData": "vitess",
      "Password": "supersecretpassword"
    }
  ],
  "myuser1": [
    {
      "UserData": "myuser1",
      "Password": "password1"
    }
  ],
  "myuser2": [
    {
      "UserData": "myuser2",
      "Password": "password2"
    }
  ]
}
EOF

使用其他命令行参数将其加载到VTGate中：

vtgate $(cat <<END_OF_COMMAND
    -mysql_auth_server_impl=static
    -mysql_auth_server_static_file=users.json
    ...
    ...
    ...
END_OF_COMMAND
)

vitess operator on kubernetes环境方案

找到vtgate所在pod，找到SecretName

kubectl get pod
NAME                                             READY   STATUS    RESTARTS   AGE
example-etcd-faf13de3-1                          1/1     Running   1          21h
example-etcd-faf13de3-2                          1/1     Running   0          21h
example-etcd-faf13de3-3                          1/1     Running   0          21h
example-vttablet-zone1-2469782763-bfadd780       3/3     Running   1          21h
example-vttablet-zone1-2548885007-46a852d0       3/3     Running   1          21h
example-zone1-vtctld-1d4dcad0-c4586f7c8-n5nfq    1/1     Running   3          21h
example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn   1/1     Running   3          21h
vitess-operator-69b8854f64-xjmn2                 1/1     Running   0          21h

kubectl describe pod example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn
Name:                 example-zone1-vtgate-bc6cde92-64bfdcfb57-5mhtn
Namespace:            default
Priority:             1000
Priority Class Name:  vitess
Node:                 minikube/10.10.30.220
Start Time:           Mon, 14 Dec 2020 17:29:18 +0800
Labels:               planetscale.com/cell=zone1
                      planetscale.com/cluster=example
                      planetscale.com/component=vtgate
                      pod-template-hash=64bfdcfb57
Annotations:          planetscale.com/secret-hash: af04fed47ed2a09bb59a670fe6fdb65c
Status:               Running
IP:                   172.17.0.5
IPs:                  <none>
Controlled By:        ReplicaSet/example-zone1-vtgate-bc6cde92-64bfdcfb57
Containers:
  vtgate:
    Container ID:  docker://86ca6d811b11666e076dececb0cf5371ceeb4f65816125dd968f26ac8a8fac4f
    Image:         vitess/lite:v6.0.20-20200429
    Image ID:      docker-pullable://vitess/lite@sha256:a74ba7fe9aa070ed471e9f17bcf7ba358f01bda87d52000e9ef2785f257105ec
    Ports:         15000/TCP, 15999/TCP, 3306/TCP
    Host Ports:    0/TCP, 0/TCP, 0/TCP
    Command:
      /vt/bin/vtgate
    Args:
      --buffer_max_failover_duration=10s
      --buffer_min_time_between_failovers=20s
      --cell=zone1
      --cells_to_watch=zone1
      --enable_buffer=true
      --gateway_implementation=discoverygateway
      --grpc_max_message_size=67108864
      --grpc_port=15999
      --logtostderr=true
      --mysql_auth_server_impl=static
      --mysql_auth_server_static_file=/vt/secrets/vtgate-static-auth/users.json
      --mysql_server_port=3306
      --port=15000
      --service_map=grpc-vtgateservice
      --tablet_types_to_wait=MASTER,REPLICA
      --topo_global_root=/vitess/example/global
      --topo_global_server_address=example-etcd-faf13de3-client:2379
      --topo_implementation=etcd2
    State:          Running
      Started:      Mon, 14 Dec 2020 17:31:33 +0800
    Last State:     Terminated
      Reason:       Error
      Exit Code:    1
      Started:      Mon, 14 Dec 2020 17:30:59 +0800
      Finished:     Mon, 14 Dec 2020 17:31:04 +0800
    Ready:          True
    Restart Count:  3
    Limits:
      memory:  256Mi
    Requests:
      cpu:        100m
      memory:     256Mi
    Liveness:     http-get http://:web/debug/status delay=300s timeout=1s period=10s #success=1 #failure=30
    Readiness:    http-get http://:web/debug/health delay=0s timeout=1s period=10s #success=1 #failure=3
    Environment:  <none>
    Mounts: ######挂载位置
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-wv9ds (ro)
      /vt/secrets/vtgate-static-auth from vtgate-static-auth-secret (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  vtgate-static-auth-secret:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  example-cluster-config      ####secretname名称
    Optional:    false
  default-token-wv9ds:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-wv9ds
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:          <none>

找到对应的users.json

kubectl get secret example-cluster-config -o yaml

kubectl get secret example-cluster-config -o yaml
apiVersion: v1
data:
  init_db.sql: IyBUaGlzIGZpbGUgaXMgZXhlY3V0ZWQgaW1tZWRpYXRlbHkgYWZ0ZXIgbXlzcWxfaW5zdGFsbF9kYiwKIyB0byBpbml0aWFsaXplIGEgZnJlc2ggZGF0YSBkaXJlY3RvcnkuCgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgRXF1aXZhbGVudCBvZiBteXNxbF9zZWN1cmVfaW5zdGFsbGF0aW9uCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCiMgQ2hhbmdlcyBkdXJpbmcgdGhlIGluaXQgZGIgc2hvdWxkIG5vdCBtYWtlIGl0IHRvIHRoZSBiaW5sb2cuCiMgVGhleSBjb3VsZCBwb3RlbnRpYWxseSBjcmVhdGUgZXJyYW50IHRyYW5zYWN0aW9ucyBvbiByZXBsaWNhcy4KU0VUIHNxbF9sb2dfYmluID0gMDsKIyBSZW1vdmUgYW5vbnltb3VzIHVzZXJzLgpERUxFVEUgRlJPTSBteXNxbC51c2VyIFdIRVJFIFVzZXIgPSAnJzsKCiMgRGlzYWJsZSByZW1vdGUgcm9vdCBhY2Nlc3MgKG9ubHkgYWxsb3cgVU5JWCBzb2NrZXQpLgpERUxFVEUgRlJPTSBteXNxbC51c2VyIFdIRVJFIFVzZXIgPSAncm9vdCcgQU5EIEhvc3QgIT0gJ2xvY2FsaG9zdCc7CgojIFJlbW92ZSB0ZXN0IGRhdGFiYXNlLgpEUk9QIERBVEFCQVNFIElGIEVYSVNUUyB0ZXN0OwoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFZpdGVzcyBkZWZhdWx0cwojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojIFZpdGVzcy1pbnRlcm5hbCBkYXRhYmFzZS4KQ1JFQVRFIERBVEFCQVNFIElGIE5PVCBFWElTVFMgX3Z0OwojIE5vdGUgdGhhdCBkZWZpbml0aW9ucyBvZiBsb2NhbF9tZXRhZGF0YSBhbmQgc2hhcmRfbWV0YWRhdGEgc2hvdWxkIGJlIHRoZSBzYW1lCiMgYXMgaW4gcHJvZHVjdGlvbiB3aGljaCBpcyBkZWZpbmVkIGluIGdvL3Z0L215c3FsY3RsL21ldGFkYXRhX3RhYmxlcy5nby4KQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgX3Z0LmxvY2FsX21ldGFkYXRhICgKICBuYW1lIFZBUkNIQVIoMjU1KSBOT1QgTlVMTCwKICB2YWx1ZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwsCiAgZGJfbmFtZSBWQVJCSU5BUlkoMjU1KSBOT1QgTlVMTCwKICBQUklNQVJZIEtFWSAoZGJfbmFtZSwgbmFtZSkKICApIEVOR0lORT1Jbm5vREI7CkNSRUFURSBUQUJMRSBJRiBOT1QgRVhJU1RTIF92dC5zaGFyZF9tZXRhZGF0YSAoCiAgbmFtZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwsCiAgdmFsdWUgTUVESVVNQkxPQiBOT1QgTlVMTCwKICBkYl9uYW1lIFZBUkJJTkFSWSgyNTUpIE5PVCBOVUxMLAogIFBSSU1BUlkgS0VZIChkYl9uYW1lLCBuYW1lKQogICkgRU5HSU5FPUlubm9EQjsKCiMgQWRtaW4gdXNlciB3aXRoIGFsbCBwcml2aWxlZ2VzLgpDUkVBVEUgVVNFUiAndnRfZGJhJ0AnbG9jYWxob3N0JzsKR1JBTlQgQUxMIE9OICouKiBUTyAndnRfZGJhJ0AnbG9jYWxob3N0JzsKR1JBTlQgR1JBTlQgT1BUSU9OIE9OICouKiBUTyAndnRfZGJhJ0AnbG9jYWxob3N0JzsKCiMgVXNlciBmb3IgYXBwIHRyYWZmaWMsIHdpdGggZ2xvYmFsIHJlYWQtd3JpdGUgYWNjZXNzLgpDUkVBVEUgVVNFUiAndnRfYXBwJ0AnbG9jYWxob3N0JzsKR1JBTlQgU0VMRUNULCBJTlNFUlQsIFVQREFURSwgREVMRVRFLCBDUkVBVEUsIERST1AsIFJFTE9BRCwgUFJPQ0VTUywgRklMRSwKICBSRUZFUkVOQ0VTLCBJTkRFWCwgQUxURVIsIFNIT1cgREFUQUJBU0VTLCBDUkVBVEUgVEVNUE9SQVJZIFRBQkxFUywKICBMT0NLIFRBQkxFUywgRVhFQ1VURSwgUkVQTElDQVRJT04gU0xBVkUsIFJFUExJQ0FUSU9OIENMSUVOVCwgQ1JFQVRFIFZJRVcsCiAgU0hPVyBWSUVXLCBDUkVBVEUgUk9VVElORSwgQUxURVIgUk9VVElORSwgQ1JFQVRFIFVTRVIsIEVWRU5ULCBUUklHR0VSCiAgT04gKi4qIFRPICd2dF9hcHAnQCdsb2NhbGhvc3QnOwoKIyBVc2VyIGZvciBhcHAgZGVidWcgdHJhZmZpYywgd2l0aCBnbG9iYWwgcmVhZCBhY2Nlc3MuCkNSRUFURSBVU0VSICd2dF9hcHBkZWJ1ZydAJ2xvY2FsaG9zdCc7CkdSQU5UIFNFTEVDVCwgU0hPVyBEQVRBQkFTRVMsIFBST0NFU1MgT04gKi4qIFRPICd2dF9hcHBkZWJ1ZydAJ2xvY2FsaG9zdCc7CgojIFVzZXIgZm9yIGFkbWluaXN0cmF0aXZlIG9wZXJhdGlvbnMgdGhhdCBuZWVkIHRvIGJlIGV4ZWN1dGVkIGFzIG5vbi1TVVBFUi4KIyBTYW1lIHBlcm1pc3Npb25zIGFzIHZ0X2FwcCBoZXJlLgpDUkVBVEUgVVNFUiAndnRfYWxscHJpdnMnQCdsb2NhbGhvc3QnOwpHUkFOVCBTRUxFQ1QsIElOU0VSVCwgVVBEQVRFLCBERUxFVEUsIENSRUFURSwgRFJPUCwgUkVMT0FELCBQUk9DRVNTLCBGSUxFLAogIFJFRkVSRU5DRVMsIElOREVYLCBBTFRFUiwgU0hPVyBEQVRBQkFTRVMsIENSRUFURSBURU1QT1JBUlkgVEFCTEVTLAogIExPQ0sgVEFCTEVTLCBFWEVDVVRFLCBSRVBMSUNBVElPTiBTTEFWRSwgUkVQTElDQVRJT04gQ0xJRU5ULCBDUkVBVEUgVklFVywKICBTSE9XIFZJRVcsIENSRUFURSBST1VUSU5FLCBBTFRFUiBST1VUSU5FLCBDUkVBVEUgVVNFUiwgRVZFTlQsIFRSSUdHRVIKICBPTiAqLiogVE8gJ3Z0X2FsbHByaXZzJ0AnbG9jYWxob3N0JzsKCiMgVXNlciBmb3Igc2xhdmUgcmVwbGljYXRpb24gY29ubmVjdGlvbnMuCiMgVE9ETzogU2hvdWxkIHdlIHNldCBhIHBhc3N3b3JkIG9uIHRoaXMgc2luY2UgaXQgYWxsb3dzIHJlbW90ZSBjb25uZWN0aW9ucz8KQ1JFQVRFIFVTRVIgJ3Z0X3JlcGwnQCclJzsKR1JBTlQgUkVQTElDQVRJT04gU0xBVkUgT04gKi4qIFRPICd2dF9yZXBsJ0AnJSc7CgojIFVzZXIgZm9yIFZpdGVzcyBmaWx0ZXJlZCByZXBsaWNhdGlvbiAoYmlubG9nIHBsYXllcikuCiMgU2FtZSBwZXJtaXNzaW9ucyBhcyB2dF9hcHAuCkNSRUFURSBVU0VSICd2dF9maWx0ZXJlZCdAJ2xvY2FsaG9zdCc7CkdSQU5UIFNFTEVDVCwgSU5TRVJULCBVUERBVEUsIERFTEVURSwgQ1JFQVRFLCBEUk9QLCBSRUxPQUQsIFBST0NFU1MsIEZJTEUsCiAgUkVGRVJFTkNFUywgSU5ERVgsIEFMVEVSLCBTSE9XIERBVEFCQVNFUywgQ1JFQVRFIFRFTVBPUkFSWSBUQUJMRVMsCiAgTE9DSyBUQUJMRVMsIEVYRUNVVEUsIFJFUExJQ0FUSU9OIFNMQVZFLCBSRVBMSUNBVElPTiBDTElFTlQsIENSRUFURSBWSUVXLAogIFNIT1cgVklFVywgQ1JFQVRFIFJPVVRJTkUsIEFMVEVSIFJPVVRJTkUsIENSRUFURSBVU0VSLCBFVkVOVCwgVFJJR0dFUgogIE9OICouKiBUTyAndnRfZmlsdGVyZWQnQCdsb2NhbGhvc3QnOwoKIyBVc2VyIGZvciBPcmNoZXN0cmF0b3IgKGh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuYXJrL29yY2hlc3RyYXRvcikuCiMgVE9ETzogUmVlbmFibGUgd2hlbiB0aGUgcGFzc3dvcmQgaXMgcmFuZG9tbHkgZ2VuZXJhdGVkLgojQ1JFQVRFIFVTRVIgJ29yY19jbGllbnRfdXNlcidAJyUnIElERU5USUZJRUQgQlkgJ29yY19jbGllbnRfdXNlcl9wYXNzd29yZCc7CiNHUkFOVCBTVVBFUiwgUFJPQ0VTUywgUkVQTElDQVRJT04gU0xBVkUsIFJFTE9BRAojICBPTiAqLiogVE8gJ29yY19jbGllbnRfdXNlcidAJyUnOwojR1JBTlQgU0VMRUNUCiMgIE9OIF92dC4qIFRPICdvcmNfY2xpZW50X3VzZXInQCclJzsKCkZMVVNIIFBSSVZJTEVHRVM7CgpSRVNFVCBTTEFWRSBBTEw7ClJFU0VUIE1BU1RFUjsK
  users.json: ewogICJ1c2VyIjogW3sKICAgICJVc2VyRGF0YSI6ICJ1c2VyIiwKICAgICJQYXNzd29yZCI6ICIiCiAgfV0KfQo=
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"example-cluster-config","namespace":"default"},"stringData":{"init_db.sql":"# This file is executed immediately after mysql_install_db,\n# to initialize a fresh data directory.\n\n###############################################################################\n# Equivalent of mysql_secure_installation\n###############################################################################\n\n# Changes during the init db should not make it to the binlog.\n# They could potentially create errant transactions on replicas.\nSET sql_log_bin = 0;\n# Remove anonymous users.\nDELETE FROM mysql.user WHERE User = '';\n\n# Disable remote root access (only allow UNIX socket).\nDELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';\n\n# Remove test database.\nDROP DATABASE IF EXISTS test;\n\n###############################################################################\n# Vitess defaults\n###############################################################################\n\n# Vitess-internal database.\nCREATE DATABASE IF NOT EXISTS _vt;\n# Note that definitions of local_metadata and shard_metadata should be the same\n# as in production which is defined in go/vt/mysqlctl/metadata_tables.go.\nCREATE TABLE IF NOT EXISTS _vt.local_metadata (\n  name VARCHAR(255) NOT NULL,\n  value VARCHAR(255) NOT NULL,\n  db_name VARBINARY(255) NOT NULL,\n  PRIMARY KEY (db_name, name)\n  ) ENGINE=InnoDB;\nCREATE TABLE IF NOT EXISTS _vt.shard_metadata (\n  name VARCHAR(255) NOT NULL,\n  value MEDIUMBLOB NOT NULL,\n  db_name VARBINARY(255) NOT NULL,\n  PRIMARY KEY (db_name, name)\n  ) ENGINE=InnoDB;\n\n# Admin user with all privileges.\nCREATE USER 'vt_dba'@'localhost';\nGRANT ALL ON *.* TO 'vt_dba'@'localhost';\nGRANT GRANT OPTION ON *.* TO 'vt_dba'@'localhost';\n\n# User for app traffic, with global read-write access.\nCREATE USER 'vt_app'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n  REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n  LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n  SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n  ON *.* TO 'vt_app'@'localhost';\n\n# User for app debug traffic, with global read access.\nCREATE USER 'vt_appdebug'@'localhost';\nGRANT SELECT, SHOW DATABASES, PROCESS ON *.* TO 'vt_appdebug'@'localhost';\n\n# User for administrative operations that need to be executed as non-SUPER.\n# Same permissions as vt_app here.\nCREATE USER 'vt_allprivs'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n  REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n  LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n  SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n  ON *.* TO 'vt_allprivs'@'localhost';\n\n# User for slave replication connections.\n# TODO: Should we set a password on this since it allows remote connections?\nCREATE USER 'vt_repl'@'%';\nGRANT REPLICATION SLAVE ON *.* TO 'vt_repl'@'%';\n\n# User for Vitess filtered replication (binlog player).\n# Same permissions as vt_app.\nCREATE USER 'vt_filtered'@'localhost';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,\n  REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,\n  LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,\n  SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER\n  ON *.* TO 'vt_filtered'@'localhost';\n\n# User for Orchestrator (https://github.com/openark/orchestrator).\n# TODO: Reenable when the password is randomly generated.\n#CREATE USER 'orc_client_user'@'%' IDENTIFIED BY 'orc_client_user_password';\n#GRANT SUPER, PROCESS, REPLICATION SLAVE, RELOAD\n#  ON *.* TO 'orc_client_user'@'%';\n#GRANT SELECT\n#  ON _vt.* TO 'orc_client_user'@'%';\n\nFLUSH PRIVILEGES;\n\nRESET SLAVE ALL;\nRESET MASTER;\n","users.json":"{\n  \"user\": [{\n    \"UserData\": \"user\",\n    \"Password\": \"\"\n  }]\n}\n"},"type":"Opaque"}
  creationTimestamp: "2020-12-14T09:29:18Z"
  name: example-cluster-config
  namespace: default
  resourceVersion: "3277"
  selfLink: /api/v1/namespaces/default/secrets/example-cluster-config
  uid: 008b89b1-9531-43b7-9de9-4b74dde0620d
type: Opaque

拿到users.json，base64解码

echo "ewogICJ1c2VyIjogW3sKICAgICJVc2VyRGF0YSI6ICJ1c2VyIiwKICAgICJQYXNzd29yZCI6ICIiCiAgfV0KfQo=" |base64 -d
{
  "user": [{
    "UserData": "user",
    "Password": ""
  }]
}

制定自己要配置的用户密码文件

$ cat > myusers.json << EOF
{
  "vitess": [
    {
      "UserData": "vitess",
      "Password": "supersecretpassword"
    }
  ],
  "myuser1": [
    {
      "UserData": "myuser1",
      "Password": "password1"
    }
  ],
  "myuser2": [
    {
      "UserData": "myuser2",
      "Password": "password2"
    }
  ]
}
EOF

加密用户密码文件

cat myusers.json |base64
ewogICJ1c2VyIjogWwp7CiAgICAiVXNlckRhdGEiOiAidXNlciIsCiAgICAiUGFzc3dvcmQiOiAiIgogIH0KXSwKICAidml0ZXNzIjogWwogICAgewogICAgICAiVXNlckRhdGEiOiAidml0ZXNzIiwKICAgICAgIlBhc3N3b3JkIjogInN1cGVyc2VjcmV0cGFzc3dvcmQiCiAgICB9CiAgXSwKICAibXl1c2VyMSI6IFsKICAgIHsKICAgICAgIlVzZXJEYXRhIjogIm15dXNlcjEiLAogICAgICAiUGFzc3dvcmQiOiAicGFzc3dvcmQxIgogICAgfQogIF0sCiAgIm15dXNlcjIiOiBbCiAgICB7CiAgICAgICJVc2VyRGF0YSI6ICJteXVzZXIyIiwKICAgICAgIlBhc3N3b3JkIjogInBhc3N3b3JkMiIKICAgIH0KICBdCn0=

验证

echo "ewogICJ1c2VyIjogWwp7CiAgICAiVXNlckRhdGEiOiAidXNlciIsCiAgICAiUGFzc3dvcmQiOiAiIgogIH0KXSwKICAidml0ZXNzIjogWwogICAgewogICAgICAiVXNlckRhdGEiOiAidml0ZXNzIiwKICAgICAgIlBhc3N3b3JkIjogInN1cGVyc2VjcmV0cGFzc3dvcmQiCiAgICB9CiAgXSwKICAibXl1c2VyMSI6IFsKICAgIHsKICAgICAgIlVzZXJEYXRhIjogIm15dXNlcjEiLAogICAgICAiUGFzc3dvcmQiOiAicGFzc3dvcmQxIgogICAgfQogIF0sCiAgIm15dXNlcjIiOiBbCiAgICB7CiAgICAgICJVc2VyRGF0YSI6ICJteXVzZXIyIiwKICAgICAgIlBhc3N3b3JkIjogInBhc3N3b3JkMiIKICAgIH0KICBdCn0=" |base64 -d
{
  "user": [
{
    "UserData": "user",
    "Password": ""
  }
],
  "vitess": [
    {
      "UserData": "vitess",
      "Password": "supersecretpassword"
    }
  ],
  "myuser1": [
    {
      "UserData": "myuser1",
      "Password": "password1"
    }
  ],
  "myuser2": [
    {
      "UserData": "myuser2",
      "Password": "password2"
    }
  ]
}

修改example-cluster-config

kubectl edit secret example-cluster-config -o yaml
修改users.json

验证

mysql -h 10.97.122.40 -P 3306 -u myuser1 -ppassword1
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.7.9-Vitess MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> quit
Bye

说明

vitess通过VTGate有自己独特的方法管理用户和权限，因此，如果通过VTGate发送,create user和grant...语法将不会有效果。

create user,grant...语法是对mysql用户使用的命令

VTGate始终用以下用户跟mysql沟通

mysql> select user,host from mysql.user;
+---------------+-----------+
| user          | host      |
+---------------+-----------+
| vt_repl       | %         |
| mysql.session | localhost |
| mysql.sys     | localhost |
| root          | localhost |
| vt_allprivs   | localhost |
| vt_app        | localhost |
| vt_appdebug   | localhost |
| vt_dba        | localhost |
| vt_filtered   | localhost |
+---------------+-----------+
9 rows in set (0.01 sec)