Skip to content

K8SPXC-1830 handle caching_sha2_password for proxysql_exporter #2384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gkech wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

K8SPXC-1830 handle caching_sha2_password for proxysql_exporter #2384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions build/pmm-prerun.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ if [[ $DB_TYPE == "mysql" ]]; then
)
fi

if [[ $DB_TYPE == "proxysql" && "${PROXYSQL_ADMIN_TLS}" == "true" ]]; then
Copy link
Copy Markdown
Contributor

@github-actions github-actions bot Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[shfmt] reported by reviewdog 🐶

Suggested change
if [[ $DB_TYPE == "proxysql" && "${PROXYSQL_ADMIN_TLS}" == "true" ]]; then
if [[ $DB_TYPE == "proxysql" && ${PROXYSQL_ADMIN_TLS} == "true" ]]; then

pmm_args+=(--tls-skip-verify)
fi

if [[ $DB_TYPE == "haproxy" ]]; then
pmm_args+=(
"$PMM_AGENT_SETUP_NODE_NAME"
Expand Down
5 changes: 5 additions & 0 deletions build/proxysql-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
# Percona scheduler
PERCONA_SCHEDULER_CFG_TMPL=/opt/percona/proxysql_scheduler_config.tmpl
if [[ -f ${PERCONA_SCHEDULER_CFG_TMPL} && -n ${PERCONA_SCHEDULER_CFG} ]]; then
cp ${PERCONA_SCHEDULER_CFG_TMPL} ${PERCONA_SCHEDULER_CFG}

Check notice on line 32 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L32 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:32:35: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
fi

# internal scheduler
Expand All @@ -39,14 +39,15 @@
sed_in_place "s/threads=2/threads=${MYSQL_THREADS:-2}/g" ${PROXY_CFG}

set +o xtrace # hide sensitive information
OPERATOR_PASSWORD_ESCAPED=$(sed 's/[][\-\!\#\$\%\&\(\)\*\+\,\.\:\;\<\=\>\?\@\^\_\~\{\}]/\\&/g' <<<"${OPERATOR_PASSWORD}")

Check notice on line 42 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L42 <ShellCheck.SC2001> 

See if you can use ${variable//search/replace} instead.
Raw output 
./build/proxysql-entrypoint.sh:42:29: info: See if you can use ${variable//search/replace} instead. (ShellCheck.SC2001)
MONITOR_PASSWORD_ESCAPED=$(sed 's/[][\-\!\#\$\%\&\(\)\*\+\,\.\:\;\<\=\>\?\@\^\_\~\{\}]/\\&/g' <<<"${MONITOR_PASSWORD}")

Check notice on line 43 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L43 <ShellCheck.SC2001> 

See if you can use ${variable//search/replace} instead.
Raw output 
./build/proxysql-entrypoint.sh:43:28: info: See if you can use ${variable//search/replace} instead. (ShellCheck.SC2001)
PROXY_ADMIN_PASSWORD_ESCAPED=$(sed 's/[][\-\!\#\$\%\&\(\)\*\+\,\.\:\;\<\=\>\?\@\^\_\~\{\}]/\\&/g' <<<"${PROXY_ADMIN_PASSWORD}")

Check notice on line 44 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L44 <ShellCheck.SC2001> 

See if you can use ${variable//search/replace} instead.
Raw output 
./build/proxysql-entrypoint.sh:44:32: info: See if you can use ${variable//search/replace} instead. (ShellCheck.SC2001)

sed_in_place "s/\"admin:admin\"/\"${PROXY_ADMIN_USER:-admin}:${PROXY_ADMIN_PASSWORD_ESCAPED:-admin}\"/g" ${PROXY_CFG}
sed_in_place "s/cluster_username=\"admin\"/cluster_username=\"${PROXY_ADMIN_USER:-admin}\"/g" ${PROXY_CFG}
sed_in_place "s/cluster_password=\"admin\"/cluster_password=\"${PROXY_ADMIN_PASSWORD_ESCAPED:-admin}\"/g" ${PROXY_CFG}
sed_in_place "s/monitor_password=\"monitor\"/monitor_password=\"${MONITOR_PASSWORD_ESCAPED:-monitor}\"/g" ${PROXY_CFG}
sed_in_place "s/stats_credentials=\"monitor:monitor\"/stats_credentials=\"${MONITOR_USERNAME:-monitor}:${MONITOR_PASSWORD_ESCAPED:-monitor}\"/g" ${PROXY_CFG}
sed_in_place "s/PROXYSQL_USERNAME='admin'/PROXYSQL_USERNAME='${PROXY_ADMIN_USER:-admin}'/g" ${PROXY_ADMIN_CFG}
sed_in_place "s/PROXYSQL_PASSWORD='admin'/PROXYSQL_PASSWORD='${PROXY_ADMIN_PASSWORD_ESCAPED:-admin}'/g" ${PROXY_ADMIN_CFG}
sed_in_place "s/CLUSTER_USERNAME='admin'/CLUSTER_USERNAME='${OPERATOR_USERNAME:-operator}'/g" ${PROXY_ADMIN_CFG}
Expand All @@ -59,21 +60,21 @@
# Percona scheduler
if [[ -f ${PERCONA_SCHEDULER_CFG} ]]; then
set +o xtrace # hide sensitive information
sed_in_place "s/SCHEDULER_PROXYSQLPASSWORD/'${PROXY_ADMIN_PASSWORD_ESCAPED:-admin}'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 63 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L63 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:63:88: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_CLUSTERPASSWORD/'${OPERATOR_PASSWORD_ESCAPED:-operator}'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 64 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L64 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:64:87: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_MONITORPASSWORD/'${MONITOR_PASSWORD_ESCAPED:-monitor}'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 65 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L65 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:65:85: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
set -o xtrace # hide sensitive information

sed_in_place "s/SCHEDULER_PROXYSQLHOST/'$(hostname -f)'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 68 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L68 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:68:60: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_CLUSTERHOST/'${PXC_SERVICE}.$(hostname -f | cut -d '.' -f3-)'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 69 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L69 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:69:92: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_CLUSTERPORT/'${CLUSTER_PORT:-3306}'/" ${PERCONA_SCHEDULER_CFG}

Check notice on line 70 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L70 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:70:66: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_MAXCONNECTIONS/${SCHEDULER_MAXCONNECTIONS}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 71 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L71 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:71:74: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_NODECHECKINTERVAL/${SCHEDULER_NODECHECKINTERVAL}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 72 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L72 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:72:80: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_CHECKTIMEOUT/${SCHEDULER_CHECKTIMEOUT}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 73 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L73 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:73:70: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_PINGTIMEOUT/${SCHEDULER_PINGTIMEOUT}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 74 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L74 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:74:68: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_RETRYDOWN/${SCHEDULER_RETRYDOWN}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 75 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L75 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:75:64: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_RETRYUP/${SCHEDULER_RETRYUP}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 76 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L76 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:76:60: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s/SCHEDULER_WRITERALSOREADER/${SCHEDULER_WRITERALSOREADER}/g" ${PERCONA_SCHEDULER_CFG}

Check notice on line 77 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L77 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:77:78: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
fi

## SSL/TLS support
Expand All @@ -85,14 +86,14 @@
if [ -f "${SSL_DIR}/ca.crt" ]; then
CA=${SSL_DIR}/ca.crt
if [[ -f ${PERCONA_SCHEDULER_CFG} ]]; then
sed_in_place "s:^sslCertificatePath.*= .*\"$:sslCertificatePath = \"${SSL_DIR}\":" ${PERCONA_SCHEDULER_CFG}

Check notice on line 89 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L89 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:89:86: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
fi
fi
SSL_INTERNAL_DIR=${SSL_INTERNAL_DIR:-/etc/proxysql/ssl-internal}
if [ -f "${SSL_INTERNAL_DIR}/ca.crt" ]; then
CA=${SSL_INTERNAL_DIR}/ca.crt
if [[ -f ${PERCONA_SCHEDULER_CFG} ]]; then
sed_in_place "s:^sslCertificatePath.*= .*\"$:sslCertificatePath = \"${SSL_INTERNAL_DIR}\":" ${PERCONA_SCHEDULER_CFG}

Check notice on line 96 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L96 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:96:95: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
fi
fi

Expand All @@ -110,11 +111,15 @@
sed_in_place "s^ssl_p2s_key=\"\"^ssl_p2s_key=\"$KEY\"^" ${PROXY_CFG}
sed_in_place "s^ssl_p2s_cert=\"\"^ssl_p2s_cert=\"$CERT\"^" ${PROXY_CFG}

sed_in_place "s^ssl_ca=\"\"^ssl_ca=\"$CA\"^" ${PROXY_CFG}
sed_in_place "s^ssl_key=\"\"^ssl_key=\"$KEY\"^" ${PROXY_CFG}
sed_in_place "s^ssl_cert=\"\"^ssl_cert=\"$CERT\"^" ${PROXY_CFG}

# Percona scheduler
if [[ -f ${PERCONA_SCHEDULER_CFG} ]]; then
sed_in_place "s:^sslCa.*=.*\"$:sslCa = \"${CA##*/}\":" ${PERCONA_SCHEDULER_CFG}

Check notice on line 120 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L120 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:120:58: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s:^sslKey.*=.*\"$:sslKey = \"${KEY##*/}\":" ${PERCONA_SCHEDULER_CFG}

Check notice on line 121 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L121 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:121:61: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
sed_in_place "s:^sslClient.*=.*\"$:sslClient = \"${CERT##*/}\":" ${PERCONA_SCHEDULER_CFG}

Check notice on line 122 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L122 <ShellCheck.SC2086> 

Double quote to prevent globbing and word splitting.
Raw output 
./build/proxysql-entrypoint.sh:122:68: info: Double quote to prevent globbing and word splitting. (ShellCheck.SC2086)
fi
fi

Expand All @@ -126,7 +131,7 @@
cp "${SSL_DIR}/ca.crt" /var/lib/proxysql/proxysql-ca.pem
fi

test -e /opt/percona/hookscript/hook.sh && source /opt/percona/hookscript/hook.sh

Check notice on line 134 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L134 <ShellCheck.SC1091> 

Not following: /opt/percona/hookscript/hook.sh: openBinaryFile: does not exist (No such file or directory)
Raw output 
./build/proxysql-entrypoint.sh:134:51: info: Not following: /opt/percona/hookscript/hook.sh: openBinaryFile: does not exist (No such file or directory) (ShellCheck.SC1091)

# Start zombie reaper to clean up processes spawned by commands
# This is needed because percona-scheduler-admin may not properly reap all child processes
Expand Down Expand Up @@ -154,7 +159,7 @@
MAIN_PID=$!

# Forward signals to main process
forward_signal() {

Check notice on line 162 in build/proxysql-entrypoint.sh

View workflow job for this annotation

GitHub Actions / shellcheck

[shellcheck] build/proxysql-entrypoint.sh#L162 <ShellCheck.SC2329> 

This function is never invoked. Check usage (or ignored if invoked indirectly).
Raw output 
./build/proxysql-entrypoint.sh:162:1: info: This function is never invoked. Check usage (or ignored if invoked indirectly). (ShellCheck.SC2329)
kill -"$1" "$MAIN_PID" 2>/dev/null || true
}
trap 'forward_signal TERM' TERM
Expand Down
4 changes: 4 additions & 0 deletions build/proxysql.cnf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ admin_variables =
cluster_mysql_servers_diffs_before_sync=1
cluster_mysql_users_diffs_before_sync=1
cluster_proxysql_servers_diffs_before_sync=1
stats_credentials="monitor:monitor"
ssl_ca=""
ssl_cert=""
ssl_key=""
}

mysql_variables=
Expand Down
11 changes: 11 additions & 0 deletions e2e-tests/monitoring-pmm3/conf/monitoring.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,17 @@ spec:
affinity:
antiAffinityTopologyKey: none
envVarsSecret: my-env-var-secrets
proxysql:
enabled: false
size: 2
image: -proxysql
resources:
requests:
memory: 500M
cpu: 300m
affinity:
antiAffinityTopologyKey: none
envVarsSecret: my-env-var-secrets
pmm:
enabled: true
image: perconalab/pmm-client:3.1.0
Expand Down
14 changes: 14 additions & 0 deletions e2e-tests/monitoring-pmm3/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,6 +282,20 @@ desc 'check haproxy metrics'
get_metric_values_pmm3 haproxy_backend_status pxc-prefix-$namespace-$cluster-haproxy-0 $NEW_TOKEN
get_metric_values_pmm3 haproxy_backend_active_servers pxc-prefix-$namespace-$cluster-haproxy-0 $NEW_TOKEN

desc 'switch from haproxy to proxysql'
kubectl_bin patch pxc ${cluster} --type=json -p '[
{"op": "replace", "path": "/spec/haproxy/enabled", "value": false},
{"op": "replace", "path": "/spec/proxysql/enabled", "value": true}
]'
wait_for_delete "sts/${cluster}-haproxy"
wait_for_running "${cluster}-proxysql" 2
sleep 60
kubectl wait pod -l 'app.kubernetes.io/managed-by=percona-xtradb-cluster-operator' --for=condition=ready --timeout=300s

desc 'check proxysql metrics'
get_metric_values_pmm3 proxysql_connection_pool_conn_used pxc-prefix-$namespace-$cluster-proxysql-0 $NEW_TOKEN
get_metric_values_pmm3 proxysql_connection_pool_status pxc-prefix-$namespace-$cluster-proxysql-0 $NEW_TOKEN

desc 'check QAN data'
get_qan20_values $cluster-pxc-0 $NEW_TOKEN

Expand Down
13 changes: 13 additions & 0 deletions pkg/pxc/app/statefulset/proxysql.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,6 +456,12 @@ func (c *Proxy) PMMContainer(ctx context.Context, cl client.Client, spec *api.PM
}

pmm3Container.Env = append(pmm3Container.Env, pmm3ProxySQLEnvVars(spec.ProxysqlParams)...)
if cr.TLSEnabled() {
pmm3Container.Env = append(pmm3Container.Env, corev1.EnvVar{
Name: "PROXYSQL_ADMIN_TLS",
Value: "true",
})
}

return &pmm3Container, nil
}
Expand Down Expand Up @@ -592,6 +598,13 @@ func (c *Proxy) PMMContainer(ctx context.Context, cl client.Client, spec *api.PM
ct.Env = append(ct.Env, sidecarEnvs...)
}

if cr.TLSEnabled() {
ct.Env = append(ct.Env, corev1.EnvVar{
Name: "PROXYSQL_ADMIN_TLS",
Value: "true",
})
}

return &ct, nil
}

Expand Down
Loading