update mysql to oracle operator (#1073)

* add export users script for MySQL Shell * remove outdated scripts * remove old database chart * refresh charts * update ingress * update gavinbunney/kubectl version * remove old MySql secret * extract phpmyadmin and redis to separate files * change MySQL to use operator
ita-social-projects · Apr 28, 2023 · f942870 · f942870
1 parent f6c75ab
commit f942870
Show file tree

Hide file tree

Showing 35 changed files with 204 additions and 430 deletions.
diff --git a/Config/export_users.py b/Config/export_users.py
@@ -0,0 +1,19 @@
+#!/bin/mysqlsh --file
+from mysqlsh import mysql
+import os
+
+# Export test database users using MySQL Shell
+
+# Using classic session, so running only pure SQL
+s = mysql.get_session('mysql://root@mysql:3306', os.getenv('ROOT_PASSWORD'))
+users = s.run_sql("""SELECT User FROM mysql.user WHERE Host != 'localhost' AND User != 'root' AND User != ''""").fetch_all()
+create_user_commands = []
+grants = []
+for user in users:
+    for cmd in s.run_sql("""SHOW CREATE USER ?""", [user[0]]).fetch_all():
+        create_user_commands.append(cmd[0])
+    for cmd in s.run_sql("""SHOW GRANTS FOR ?""", [user[0]]).fetch_all():
+        grants.append(cmd[0])
+
+result = create_user_commands + grants + ['']
+print(";\n".join(result))
diff --git a/Config/initDbServer.bat b/Config/initDbServer.bat
diff --git a/Config/initDbServer.sh b/Config/initDbServer.sh
diff --git a/Config/sql-edge.bat b/Config/sql-edge.bat
diff --git a/Terraform/GCP/k8s/ingress.tf b/Terraform/GCP/k8s/ingress.tf
@@ -1,6 +1,6 @@
 resource "helm_release" "ingress" {
   name             = "ingress"
-  chart            = "../../k8s/infrastructure/charts/ingress-nginx-4.3.0.tgz"
+  chart            = "../../k8s/infrastructure/charts/ingress-nginx-4.6.0.tgz"
   namespace        = "ingress-nginx"
   create_namespace = true
   wait             = true

diff --git a/Terraform/GCP/k8s/main.tf b/Terraform/GCP/k8s/main.tf
@@ -8,7 +8,7 @@ terraform {
     }
     kubectl = {
       source  = "gavinbunney/kubectl"
-      version = ">= 1.7.0"
+      version = ">= 1.14.0"
     }
   }
 }

diff --git a/Terraform/GCP/k8s/mysql.tf b/Terraform/GCP/k8s/mysql.tf
@@ -1,38 +1,44 @@
+resource "helm_release" "mysql_operator" {
+  name             = "mysql-operator"
+  chart            = "../../k8s/infrastructure/charts/mysql-operator-2.0.9.tgz"
+  namespace        = "mysql-operator"
+  create_namespace = true
+  wait             = true
+  wait_for_jobs    = true
+}
+
+resource "kubernetes_persistent_volume_claim" "backup_pvc" {
+  metadata {
+    name      = "mysql-backup-pvc"
+    namespace = data.kubernetes_namespace.oos.metadata[0].name
+  }
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = "10Gi"
+      }
+    }
+    storage_class_name = "standard"
+  }
+}
+
 resource "helm_release" "mysql" {
   name          = "mysql"
-  chart         = "../../k8s/database"
+  chart         = "../../k8s/infrastructure/charts/mysql-innodbcluster-2.0.9.tgz"
   namespace     = data.kubernetes_namespace.oos.metadata[0].name
   wait          = true
   wait_for_jobs = true
   values = [
     "${file("${path.module}/values/mysql.yaml")}"
   ]
   set {
-    name  = "phpmyadmin.ingress.annotations.nginx\\.ingress\\.kubernetes\\.io/whitelist-source-range"
-    value = join("\\,", var.admin_ips)
-  }
-  set {
-    name  = "phpmyadmin.ingress.hostname"
-    value = var.phpmyadmin_hostname
+    name  = "credentials.root.password"
+    value = var.sql_root_pass
   }
   depends_on = [
-    kubernetes_secret.sql_credentials,
-    kubernetes_secret.sql_api_credentials,
-    helm_release.ingress
-  ]
-}
-
-resource "helm_release" "redis" {
-  name          = "redis"
-  chart         = "../../k8s/infrastructure/charts/redis-17.9.3.tgz"
-  namespace     = data.kubernetes_namespace.oos.metadata[0].name
-  wait          = true
-  wait_for_jobs = true
-  values = [
-    "${file("${path.module}/../../../k8s/infrastructure/redis.yaml")}"
-  ]
-  depends_on = [
-    kubernetes_secret.redis_credentials,
-    helm_release.ingress
+    helm_release.mysql_operator,
+    helm_release.ingress,
+    kubernetes_persistent_volume_claim.backup_pvc
   ]
 }
diff --git a/Terraform/GCP/k8s/phpmyadmin.tf b/Terraform/GCP/k8s/phpmyadmin.tf
@@ -0,0 +1,22 @@
+resource "helm_release" "phpmyadmin" {
+  name          = "phpmyadmin"
+  chart         = "../../k8s/infrastructure/charts/phpmyadmin-11.0.0.tgz"
+  namespace     = data.kubernetes_namespace.oos.metadata[0].name
+  wait          = true
+  wait_for_jobs = true
+  values = [
+    "${file("${path.module}/values/phpmyadmin.yaml")}"
+  ]
+  set {
+    name  = "ingress.annotations.nginx\\.ingress\\.kubernetes\\.io/whitelist-source-range"
+    value = join("\\,", var.admin_ips)
+  }
+  set {
+    name  = "ingress.hostname"
+    value = var.phpmyadmin_hostname
+  }
+  depends_on = [
+    helm_release.ingress,
+    helm_release.mysql
+  ]
+}
diff --git a/Terraform/GCP/k8s/redis.tf b/Terraform/GCP/k8s/redis.tf
@@ -0,0 +1,14 @@
+resource "helm_release" "redis" {
+  name          = "redis"
+  chart         = "../../k8s/infrastructure/charts/redis-17.9.3.tgz"
+  namespace     = data.kubernetes_namespace.oos.metadata[0].name
+  wait          = true
+  wait_for_jobs = true
+  values = [
+    "${file("${path.module}/../../../k8s/infrastructure/redis.yaml")}"
+  ]
+  depends_on = [
+    kubernetes_secret.redis_credentials,
+    helm_release.ingress
+  ]
+}
diff --git a/Terraform/GCP/k8s/secrets.tf b/Terraform/GCP/k8s/secrets.tf
@@ -1,24 +1,12 @@
-resource "kubernetes_secret" "sql_credentials" {
-  metadata {
-    name      = "mysql-auth"
-    namespace = data.kubernetes_namespace.oos.metadata[0].name
-  }
-
-  data = {
-    mysql-root-password        = var.sql_root_pass
-    mysql-replication-password = var.sql_auth_pass
-    mysql-password             = var.sql_auth_pass
-  }
-}
-
 resource "kubernetes_secret" "sql_api_credentials" {
   metadata {
     name      = "mysql-api-auth"
     namespace = data.kubernetes_namespace.oos.metadata[0].name
   }
 
   data = {
-    API_PASSWORD = var.sql_api_pass
+    API_PASSWORD      = var.sql_api_pass
+    IDENTITY_PASSWORD = var.sql_auth_pass
   }
 }
 
@@ -44,4 +32,4 @@ resource "kubernetes_secret" "redis_credentials" {
   data = {
     password = var.redis_pass
   }
-}
+}
diff --git a/Terraform/GCP/k8s/values/elastic.yaml b/Terraform/GCP/k8s/values/elastic.yaml
@@ -139,7 +139,7 @@ kibana:
 
 vector:
   enabled: true
-  
+
   # fullnameOverride -- Override the full name of resources.
   fullnameOverride: vector
 
@@ -155,11 +155,11 @@ vector:
       memory: 64M
     limits:
       memory: 512M
-  
+
   service:
     ports:
       - port: 8686
-  
+
   env:
     - name: "ES_ENDPOINT"
       value: "http://elasticsearch-master.default.svc:9200"
@@ -177,7 +177,7 @@ vector:
   # customConfig -- Override Vector's default configs, if used **all** options need to be specified. This section supports
   # using helm templates to populate dynamic values. See Vector's [configuration documentation](https://vector.dev/docs/reference/configuration/)
   # for all options.
-  customConfig: 
+  customConfig:
     data_dir: /vector-data-dir
     api:
       enabled: false
@@ -234,20 +234,20 @@ metricbeat:
           secretKeyRef:
             name: elasticsearch-credentials
             key: password
-  
+
     hostNetworking: true
 
-    extraVolumeMounts: 
+    extraVolumeMounts:
       - name: mtab
         mountPath: /etc/mtab
         readOnly: true
-    
-    extraVolumes: 
+
+    extraVolumes:
       - name: mtab
         hostPath:
           path: /etc/mtab
-          type: File 
-    
+          type: File
+
     metricbeatConfig:
       metricbeat.yml: |-
         metricbeat.modules:
@@ -292,7 +292,7 @@ metricbeat:
             metricsets:
               - filesystem
               - fsstat
-            filesystem.ignore_types: []  
+            filesystem.ignore_types: []
             processors:
             - drop_event.when.regexp:
                 system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
@@ -345,7 +345,7 @@ metricbeat:
         valueFrom:
           secretKeyRef:
             name: elastic-metricbeat-mysql
-            key: user       
+            key: user
       - name: "REDIS_PASSWORD"
         valueFrom:
           secretKeyRef:
@@ -354,8 +354,8 @@ metricbeat:
       - name: "MYSQL_PASSWORD"
         valueFrom:
           secretKeyRef:
-            name: mysql-auth
-            key: mysql-password            
+            name: mysql-api-auth
+            key: IDENTITY_PASSWORD
     metricbeatConfig:
       metricbeat.yml: |-
         metricbeat.modules:
@@ -390,14 +390,14 @@ metricbeat:
             xpack.enabled: true
           - module: kibana
             period: 60s
-            hosts: 
+            hosts:
               - "${KIBANA_URL}"
             username: "${ES_USERNAME}"
-            password: "${ES_PASSWORD}" 
+            password: "${ES_PASSWORD}"
             ssl:
               enable: false
             enabled: true
-            xpack.enabled: true 
+            xpack.enabled: true
           - module: mysql
             enabled: true
             metricsets: ["status"]
@@ -419,7 +419,7 @@ metricbeat:
           username: '${ES_USERNAME}'
           password: '${ES_PASSWORD}'
           enabled: true
-          allow_older_versions: true    
+          allow_older_versions: true
 
     secretMounts:
       - name: elasticsearch-master-certs
@@ -441,7 +441,7 @@ metricbeat:
   secrets:
     - name: "mysql"
       value:
-        user: 
+        user:
 
   # Replicas being used for the kube-state-metrics metricbeat deployment
   replicas: 1

diff --git a/Terraform/GCP/k8s/values/ingress.yaml b/Terraform/GCP/k8s/values/ingress.yaml
@@ -16,6 +16,7 @@ controller:
 defaultBackend:
   enabled: true
   autoscaling:
-    enabled: true
+    # TODO: wait till the bug fix will be updated as a chart of HPA
+    enabled: false
     minReplicas: 1
     maxReplicas: 2