Skip to content

Commit 42763be

Browse files
committed
PSQLADM-574: Add configurable AUTH_PLUGIN and stabilize scheduler test config selection
https://perconadev.atlassian.net/browse/PSQLADM-574 - Add AUTH_PLUGIN support across admin/scheduler SQL paths and user creation flows. - The default AUTH_PLUGIN is set to caching_sha2_password in shared config/common layer. - Validate AUTH_PLUGIN values and fail fast on unsupported plugins - Update test suites to use AUTH_PLUGIN-aware CREATE USER statements - Add auth plugin compatibility test to still test with mysql_native_password plugin which can be skipped by using skip-auth-plugin-compat-test option(disabled by default). - Improve scheduler test orchestration by switching testsuite.toml clusterPort/hgW/hgR between cluster runs. - Increase timeout for syncusers(many users) test. - Add a filter to exclude percona.telemetry user in tests which use user count to check for failure.
1 parent 060e863 commit 42763be

9 files changed

Lines changed: 214 additions & 110 deletions

percona-scheduler-admin

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ function exec_sql() {
358358
local more_options=""
359359
local retvalue
360360
local retoutput
361-
local default_auth=""
361+
local auth_option=""
362362
local defaults=""
363363

364364
if [[ $# -ge 7 ]]; then
@@ -372,7 +372,7 @@ function exec_sql() {
372372
debug "$lineno" "exec_sql : $user@$hostname:$port ==> $query"
373373

374374
if [[ $MYSQL_CLIENT_VERSION == "8.0" ]]; then
375-
default_auth="default-auth=mysql_native_password"
375+
auth_option="default-auth=${AUTH_PLUGIN}"
376376
fi
377377

378378
defaults=$(printf '[client]\nuser=%s\npassword="%s"\nhost=%s\nport=%s\nconnect-timeout=%s\n%s' \
@@ -381,7 +381,7 @@ function exec_sql() {
381381
"${hostname}" \
382382
"${port}" \
383383
"${TIMEOUT}" \
384-
"${default_auth}"
384+
"${auth_option}"
385385
)
386386

387387
if [[ $USE_STDIN_FOR_CREDENTIALS -eq 1 ]]; then
@@ -692,7 +692,7 @@ function user_input_check() {
692692
"\n-- Please check the ProxySQL connection parameters and status."
693693

694694
if [[ -z "$precheck_user" ]]; then
695-
mysql_exec "$LINENO" "CREATE USER '$safe_username'@'$USER_HOST_RANGE' IDENTIFIED WITH mysql_native_password BY '$safe_password';"
695+
mysql_exec "$LINENO" "CREATE USER '$safe_username'@'$USER_HOST_RANGE' IDENTIFIED WITH ${AUTH_PLUGIN} BY '$safe_password';"
696696
check_cmd $? "$LINENO" "Failed to add the PXC application user to PXC: $username" \
697697
"\n-- Please check if '$CLUSTER_USERNAME'@'$CLUSTER_HOSTNAME' has the proper permissions to create the montioring user"
698698

@@ -1174,7 +1174,7 @@ function enable_proxysql() {
11741174
"\n-- Please check the PXC cluster connection parameters and status."
11751175
if [[ -z "$check_user" ]]; then
11761176
# No monitor user found in MySQL, create the monitor user
1177-
mysql_exec "$LINENO" "CREATE USER '$SAFE_MONITOR_USERNAME'@'$USER_HOST_RANGE' IDENTIFIED WITH mysql_native_password BY '$SAFE_MONITOR_PASSWORD';"
1177+
mysql_exec "$LINENO" "CREATE USER '$SAFE_MONITOR_USERNAME'@'$USER_HOST_RANGE' IDENTIFIED WITH ${AUTH_PLUGIN} BY '$SAFE_MONITOR_PASSWORD';"
11781178
check_cmd $? "$LINENO" "Failed to create the ProxySQL monitoring user."\
11791179
"\n-- Please check that '$CLUSTER_USERNAME'@'$CLUSTER_HOSTNAME' has the proper permissions to create the montioring user"
11801180
fi

proxysql-admin

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,7 @@ function user_input_check() {
525525
"\n-- Please check the ProxySQL connection parameters and status."
526526

527527
if [[ -z "$precheck_user" ]]; then
528-
mysql_exec "$LINENO" "CREATE USER '$safe_username'@'$USER_HOST_RANGE' IDENTIFIED WITH mysql_native_password BY '$safe_password';"
528+
mysql_exec "$LINENO" "CREATE USER '$safe_username'@'$USER_HOST_RANGE' IDENTIFIED WITH ${AUTH_PLUGIN} BY '$safe_password';"
529529
check_cmd $? "$LINENO" "Failed to add the PXC application user to PXC: $username" \
530530
"\n-- Please check if '$CLUSTER_USERNAME'@'$CLUSTER_HOSTNAME' has the proper permissions to create the montioring user"
531531

@@ -901,7 +901,7 @@ function enable_proxysql() {
901901
"\n-- Please check the PXC cluster connection parameters and status."
902902
if [[ -z "$check_user" ]]; then
903903
# No monitor user found in MySQL, create the monitor user
904-
mysql_exec "$LINENO" "CREATE USER '$SAFE_MONITOR_USERNAME'@'$USER_HOST_RANGE' IDENTIFIED WITH mysql_native_password BY '$SAFE_MONITOR_PASSWORD';"
904+
mysql_exec "$LINENO" "CREATE USER '$SAFE_MONITOR_USERNAME'@'$USER_HOST_RANGE' IDENTIFIED WITH ${AUTH_PLUGIN} BY '$SAFE_MONITOR_PASSWORD';"
905905
check_cmd $? "$LINENO" "Failed to create the ProxySQL monitoring user."\
906906
"\n-- Please check that '$CLUSTER_USERNAME'@'$CLUSTER_HOSTNAME' has the proper permissions to create the montioring user"
907907

@@ -2423,6 +2423,13 @@ function parse_args() {
24232423
exit 1
24242424
fi
24252425

2426+
if [[ $AUTH_PLUGIN != "caching_sha2_password" && $AUTH_PLUGIN != "mysql_native_password" ]]; then
2427+
error "" "Invalid AUTH_PLUGIN value: '$AUTH_PLUGIN'"
2428+
echo "Please use one of these values: 'caching_sha2_password', 'mysql_native_password'"
2429+
exit 1
2430+
fi
2431+
readonly AUTH_PLUGIN
2432+
24262433
if [[ $NEEDS_WRITER_HOSTGROUP -eq 1 ]]; then
24272434
if [[ -z $WRITER_HOSTGROUP_ID || $WRITER_HOSTGROUP_ID -eq -1 ]]; then
24282435
error "" "Invalid --writer-hg value: '$WRITER_HOSTGROUP_ID' "

proxysql-admin-common

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ function exec_sql() {
7070
local more_options=""
7171
local retvalue
7272
local retoutput
73-
local default_auth=""
73+
local auth_option=""
7474
local defaults=""
7575

7676
if [[ $# -ge 7 ]]; then
@@ -84,7 +84,7 @@ function exec_sql() {
8484
debug "$lineno" "exec_sql : $user@$hostname:$port ==> $query"
8585

8686
if [[ $MYSQL_CLIENT_VERSION == "8.0" ]]; then
87-
default_auth="default-auth=mysql_native_password"
87+
auth_option="default-auth=${AUTH_PLUGIN}"
8888
fi
8989

9090
defaults=$(printf '[client]\nuser=%s\npassword="%s"\nhost=%s\nport=%s\nconnect-timeout=%s\n%s' \
@@ -93,7 +93,7 @@ function exec_sql() {
9393
"${hostname}" \
9494
"${port}" \
9595
"${TIMEOUT}" \
96-
"${default_auth}"
96+
"${auth_option}"
9797
)
9898

9999
# shellcheck disable=SC2086

proxysql-admin.cnf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,9 @@ export USE_SSL='no'
7575
# the read hostgroup.
7676
#
7777
export WRITERS_ARE_READERS='backup'
78+
79+
# --------------------------------
80+
# MySQL authentication plugin to use when creating users.
81+
# Valid values: 'caching_sha2_password' (default) or 'mysql_native_password'
82+
#
83+
export AUTH_PLUGIN='caching_sha2_password'

proxysql-common

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,13 @@ fi
4747
#
4848
# Script parameters/constants
4949
#
50-
readonly PROXYSQL_ADMIN_VERSION="3.0.6"
50+
readonly PROXYSQL_ADMIN_VERSION="3.0.9"
5151

5252
# The minimum required openssl version
5353
readonly REQUIRED_OPENSSL_VERSION="3.0.0"
5454

55+
declare AUTH_PLUGIN="caching_sha2_password"
56+
5557
# The name of the openssl binary packaged with proxysql-admin
5658
readonly PROXYSQL_ADMIN_OPENSSL_NAME="proxysql-admin-openssl"
5759

proxysql-status

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ function mysql_exec() {
142142
local retvalue
143143
local retoutput
144144
local defaults=""
145-
local default_auth=""
145+
local auth_option=""
146146

147147
# shellcheck disable=SC2086
148148
if [[ $CREDENTIALS_FROM_CLIENT_CONFIG -eq 0 ]]; then
@@ -151,7 +151,7 @@ function mysql_exec() {
151151
"${PASSWORD}" \
152152
"${HOST}" \
153153
"${PORT}" \
154-
"${default_auth}"
154+
"${auth_option}"
155155
)
156156

157157
if [[ $USE_STDIN_FOR_CREDENTIALS -eq 1 ]]; then

tests/proxysql-admin-testsuite.bats

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ fi
172172
echo "$LINENO : Check query rule count for user(test_query_rule) found:$run_query_rule expect:0" >&2
173173
[[ "$run_query_rule" -eq 0 ]]
174174

175-
mysql_exec "$HOST_IP" "$PORT_3" "create user test_query_rule@'%' identified by 'test';"
175+
mysql_exec "$HOST_IP" "$PORT_3" "CREATE USER test_query_rule@'%' IDENTIFIED WITH ${AUTH_PLUGIN} BY 'test';"
176176
# Give the cluster some time for this to replicate
177177
sleep 3
178178

@@ -226,20 +226,20 @@ fi
226226
else
227227
pass_field="authentication_string"
228228
fi
229-
cluster_user_count=$(cluster_exec "select count(distinct user) from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'mysql.%'" -Ns)
229+
cluster_user_count=$(cluster_exec "select count(distinct user) from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'mysql.%' and user not like 'percona.%'" -Ns)
230230

231231
# HACK: this mismatch occurs because we are running the tests for cluster_two
232232
# right after the test for cluster_one (multi-cluster scenario), so the
233233
# user counts will be off (because user cluster_one will still be in proxysql users).
234234
if [[ $WSREP_CLUSTER_NAME == "cluster_two" ]]; then
235-
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not in ('cluster_one')" | awk '{print $0}')
235+
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not in ('cluster_one') and username not like 'percona.%'" | awk '{print $0}')
236236
else
237-
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users" | awk '{print $0}')
237+
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not like 'percona.%'" | awk '{print $0}')
238238
fi
239239

240240
# Dump the user lists for debugging
241241
echo "cluster users" >&2
242-
cluster_exec "select user,host from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'mysql.%'" >&2
242+
cluster_exec "select user,host from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'percona.%' and user not like 'mysql.%'" >&2
243243
echo "" >&2
244244
echo "proxysql users" >&2
245245
proxysql_exec "select * from runtime_mysql_users" "-t" >&2
@@ -259,7 +259,7 @@ fi
259259

260260
# Step 1: Create the user in MySQL
261261
echo "$LINENO: Creating user '$user' in MySQL" >&2
262-
mysql_exec "$HOST_IP" "$PORT_3" "CREATE USER '$user'@'%' IDENTIFIED WITH mysql_native_password BY '$initial_password';"
262+
mysql_exec "$HOST_IP" "$PORT_3" "CREATE USER '$user'@'%' IDENTIFIED WITH ${AUTH_PLUGIN} BY '$initial_password';"
263263
mysql_exec "$HOST_IP" "$PORT_3" "GRANT ALL PRIVILEGES ON *.* TO '$user'@'%';"
264264
sleep 3 # Allow replication
265265

@@ -319,15 +319,15 @@ fi
319319
else
320320
pass_field="authentication_string"
321321
fi
322-
cluster_user_count=$(cluster_exec "select count(distinct user) from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'mysql.%'" -Ns)
322+
cluster_user_count=$(cluster_exec "select count(distinct user) from mysql.user where ${pass_field} != '' and user not in ('admin') and user not like 'mysql.%' and user not like 'percona.%'" -Ns)
323323

324324
# HACK: this mismatch occurs because we are running the tests for cluster_two
325325
# right after the test for cluster_one (multi-cluster scenario), so the
326326
# user counts will be off (because user cluster_one will still be in proxysql users).
327327
if [[ $WSREP_CLUSTER_NAME == "cluster_two" ]]; then
328-
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not in ('cluster_one')" | awk '{print $0}')
328+
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not in ('cluster_one') and username not like 'percona.%'" | awk '{print $0}')
329329
else
330-
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users" | awk '{print $0}')
330+
proxysql_user_count=$(proxysql_exec "select count(distinct username) from runtime_mysql_users where username not like 'percona.%'" | awk '{print $0}')
331331
fi
332332

333333
# Verify that the user is not in ProxySQL
@@ -338,7 +338,7 @@ fi
338338
echo "Creating 1000 mysql users"
339339
for i in $(seq -w 1 1000)
340340
do
341-
mysql_exec "$HOST_IP" "$PORT_3" "CREATE USER 'a - u0$i'@'%' IDENTIFIED WITH mysql_native_password BY 'Secret1!';"
341+
mysql_exec "$HOST_IP" "$PORT_3" "CREATE USER 'a - u0$i'@'%' IDENTIFIED WITH ${AUTH_PLUGIN} BY 'Secret1!';"
342342
done
343343

344344
# Give the cluster some time for this to replicate
@@ -359,8 +359,8 @@ fi
359359

360360
echo "time taken: $time_taken seconds"
361361
# Expected time to process 1000 users is about 25 seconds.
362-
# For this test, lets assume that it takes less than 2.5 minutes.
363-
[[ $time_taken -le 150 ]]
362+
# For this test, lets assume that it takes less than 4 minutes.
363+
[[ $time_taken -le 240 ]]
364364

365365
echo "$output" >&2
366366
[ "$status" -eq 0 ]
@@ -415,7 +415,7 @@ fi
415415
[[ $proxysql_count -eq 0 ]]
416416

417417
# Create a user on the async node
418-
mysql_exec "$HOST_IP" "$ASYNC_PORT" "CREATE USER '${server_user}'@'%' IDENTIFIED WITH mysql_native_password BY 'passwd';"
418+
mysql_exec "$HOST_IP" "$ASYNC_PORT" "CREATE USER '${server_user}'@'%' IDENTIFIED WITH ${AUTH_PLUGIN} BY 'passwd';"
419419

420420
run sudo PATH=$WORKDIR:$PATH $WORKDIR/proxysql-admin --syncusers --server=${HOST_IP}:${ASYNC_PORT}
421421
echo "$output" >&2
@@ -444,7 +444,7 @@ fi
444444
[[ $proxysql_count -eq 0 ]]
445445

446446
# Create a user on the async node
447-
mysql_exec "$HOST_IP" "$ASYNC_PORT" "CREATE USER '${server_user}'@'%' IDENTIFIED WITH mysql_native_password BY 'passwd';"
447+
mysql_exec "$HOST_IP" "$ASYNC_PORT" "CREATE USER '${server_user}'@'%' IDENTIFIED WITH ${AUTH_PLUGIN} BY 'passwd';"
448448

449449
run sudo PATH=$WORKDIR:$PATH $WORKDIR/proxysql-admin --sync-multi-cluster-users --server=${HOST_IP}:${ASYNC_PORT}
450450
echo "$output" >&2

0 commit comments

Comments
 (0)