Kubernetes搭建mysqlMYSQL_ROOT_PASSWORD与MYSQL_ALLOW_EMPTY_PASSWORD不生效问题，登录报Access denied for user ‘user

痛定思痛。 2022-12-15 03:37 269阅读 0赞

# Kubernetes搭建mysqlMYSQL\_ROOT\_PASSWORD与MYSQL\_ALLOW\_EMPTY\_PASSWORD不生效问题,登录报Access denied for user ‘username’@‘localhost’ to database ‘mysql’ #

网上试了很多方法都不行，使用secret与直接写value，pod创建成功后进入pod，mysql登录不上。使用mysql -h 127.0.0.1 -uroot -p 报Access denied for user ‘username’@‘localhost’ to database ‘mysql’。

#后来想到在mysql-configmap.yaml加入skip-grant-tables，然后不用密码登录mysql。
    #查询用户的账户密码，发现authentication_string 是被加密的。
    select host,user,authentication_string from mysql.user;  
    #针对localhost修改root的账户密码
    ALTER USER 'root'@'localhost' IDENTIFIED BY 'Tom579#$%^&'; 
    flush privileges;
    
    #exit后再次登录即可。然后删掉mysql-statefulset，再重新创建。打开pod，使用刚才设置的密码可以登陆，
    #但是 MYSQL_ROOT_PASSWORD登录报Access denied for user 'username'@'localhost' to database 'mysql'。
    #这时候想明白在第一次创建实例的时候，如果设置了MYSQL_ROOT_PASSWORD，那么该密码将会持久化到数据库中。
    #之后创建MYSQL_ROOT_PASSWORD并不会刷新数据库中的root密码，密码依旧是之前创建的。

相关yaml文件为：注意：带your的需要修改的地方

##### mysql-stateful.yaml #####

apiVersion: apps/v1
    kind: StatefulSet
    metadata:
      name: mysql
    spec:
      selector:
        matchLabels:
          app: mysql
      serviceName: mysql
      replicas: 2
      template:
        metadata:
          labels:
            app: mysql
        spec:
          initContainers:
          - name: init-mysql
            image: mysql:5.7
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
    
            command:
            - bash
            - "-c"
            - |
              set -ex
              # Generate mysql server-id from pod ordinal index.
              [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
              ordinal=${ BASH_REMATCH[1]}
              echo [mysqld] > /mnt/conf.d/server-id.cnf
              # Add an offset to avoid reserved server-id=0 value.
              echo server-id=$((100 + $ordinal)) >> /mnt/conf.d/server-id.cnf
              # Copy appropriate conf.d files from config-map to emptyDir.
              if [[ $ordinal -eq 0 ]]; then
                cp /mnt/config-map/master.cnf /mnt/conf.d/
              else
                cp /mnt/config-map/slave.cnf /mnt/conf.d/
              fi
            volumeMounts:
            - name: conf
              mountPath: /mnt/conf.d
            - name: config-map
              mountPath: /mnt/config-map
          - name: clone-mysql
            image: gcr.io/google-samples/xtrabackup:1.0
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
            command:
            - bash
            - "-c"
            - |
              set -ex
              # Skip the clone if data already exists.
              [[ -d /var/lib/mysql/mysql ]] && exit 0
              # Skip the clone on master (ordinal index 0).
              [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
              ordinal=${ BASH_REMATCH[1]}
              [[ $ordinal -eq 0 ]] && exit 0
              # Clone data from previous peer.
              ncat --recv-only mysql-$(($ordinal-1)).mysql 3307 | xbstream -x -C /var/lib/mysql
              # Prepare the backup.
              xtrabackup --prepare --target-dir=/var/lib/mysql
            volumeMounts:
            - name: nfs-pvc
              mountPath: /var/lib/mysql
              subPath: mysql
            - name: conf
              mountPath: /etc/mysql/conf.d
          containers:
          - name: mysql
            image: mysql:5.7
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
            - name: MYSQL_USER
              value: server
            - name: MYSQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
            ports:
            - name: mysql
              containerPort: 3306
            volumeMounts:
            - name: your pvc
              mountPath: /var/lib/mysql
              subPath: mysql
            - name: conf
              mountPath: /etc/mysql/conf.d
            resources:
              requests:
                cpu: 500m
                memory: 1Gi
            livenessProbe:
              exec:
                command: ["mysqladmin", "-uroot", "-p$MYSQL_ROOT_PASSWORD", "ping"]
              initialDelaySeconds: 30
              periodSeconds: 10
              timeoutSeconds: 5
            readinessProbe:
              exec:
                # Check we can execute queries over TCP (skip-networking is off).
                command:
                - /bin/sh
                - -ec
                - >-
                  mysql -h127.0.0.1 -uroot -p$MYSQL_ROOT_PASSWORD -e'SELECT 1'
              initialDelaySeconds: 5
              periodSeconds: 2
              timeoutSeconds: 1
          - name: xtrabackup
            image: gcr.io/google-samples/xtrabackup:1.0
            env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
            ports:
            - name: xtrabackup
              containerPort: 3307
            command:
            - bash
            - "-c"
            - |
              set -ex
              cd /var/lib/mysql
    
              # Determine binlog position of cloned data, if any.
              if [[ -f xtrabackup_slave_info ]]; then
                # XtraBackup already generated a partial "CHANGE MASTER TO" query
                # because we're cloning from an existing slave.
                mv xtrabackup_slave_info change_master_to.sql.in
                # Ignore xtrabackup_binlog_info in this case (it's useless).
                rm -f xtrabackup_binlog_info
              elif [[ -f xtrabackup_binlog_info ]]; then
                # We're cloning directly from master. Parse binlog position.
                [[ `cat xtrabackup_binlog_info` =~ ^(.*?)[[:space:]]+(.*?)$ ]] || exit 1
                rm xtrabackup_binlog_info
                echo "CHANGE MASTER TO MASTER_LOG_FILE='${BASH_REMATCH[1]}',\ MASTER_LOG_POS=${BASH_REMATCH[2]}" > change_master_to.sql.in
              fi
    
              # Check if we need to complete a clone by starting replication.
              if [[ -f change_master_to.sql.in ]]; then
                echo "Waiting for mysqld to be ready (accepting connections)"
                until mysql -h 127.0.0.1 -uroot -p$MYSQL_ROOT_PASSWORD -e "SELECT 1"; do sleep 1; done
    
                echo "Initializing replication from clone position"
                # In case of container restart, attempt this at-most-once.
                mv change_master_to.sql.in change_master_to.sql.orig
                mysql -h 127.0.0.1 -uroot -p$MYSQL_ROOT_PASSWORD <<EOF
              $(<change_master_to.sql.orig),
                MASTER_HOST='mysql-0.mysql',
                MASTER_USER='root',
                MASTER_PASSWORD='$MYSQL_ROOT_PASSWORD',
                MASTER_CONNECT_RETRY=10;
              START SLAVE USER='root' PASSWORD='$MYSQL_ROOT_PASSWORD';
              EOF
              fi
    
              # Start a server to send backups when requested by peers.
              exec ncat --listen --keep-open --send-only --max-conns=1 3307 -c \
                "xtrabackup --backup --slave-info --stream=xbstream --host=127.0.0.1 --user=root --password=$MYSQL_ROOT_PASSWORD"
            volumeMounts:
            - name: your pvc
              mountPath: /var/lib/mysql
              subPath: mysql
            - name: conf
              mountPath: /etc/mysql/conf.d
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
          volumes:
          - name: conf
            emptyDir: { }
          - name: config-map
            configMap:
              name: mysql
      volumeClaimTemplates:
        - kind: PersistentVolumeClaim
          apiVersion: v1
          metadata:
            name: your pvc
            creationTimestamp: null
          spec:
            accessModes:
              - ReadWriteMany
            resources:
              requests:
                storage: 10Gi
            storageClassName: your storageClassName

#### mysql-configmap.yaml ####

kind: ConfigMap
    apiVersion: v1
    metadata:
      name: mysql
      namespace: default
      labels:
        app: mysql
    data:
      master.cnf: |
        # Apply this config only on the master.
        [mysqld]
        log-bin
    #    skip-grant-tables
      slave.cnf: |
        # Apply this config only on slaves.
        [mysqld]
        super-read-only
    #    skip-grant-tables

##### mysql-script.yaml #####

apiVersion: v1
    kind: Secret
    metadata:
      name: mysql-secret
    type: Qpaque
    data:
      password: your password (base64)
      username:  your username(base64)