Skip to content

Commit 36383ed

Browse files
LukasAudLukasAud
authored
Merge pull request #1478 from jan-win1993/mysql-8-xtrabackup-privilege
MySQL 8.0: Grant required privileges to xtrabackup user
2 parents 870e44c + f4e690b commit 36383ed

File tree

4 files changed

+118
-15
lines changed

4 files changed

+118
-15
lines changed

‎lib/facter/mysqld_version.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
# frozen_string_literal: true
22

33
Facter.add('mysqld_version') do
4-
confine { Facter::Core::Execution.which('mysqld') }
4+
confine { Facter::Core::Execution.which('mysqld') || Facter::Core::Execution.which('/usr/libexec/mysqld') }
55
setcode do
6-
Facter::Core::Execution.execute('mysqld --no-defaults -V 2>/dev/null')
6+
# Add /usr/libexec to PATH to find mysqld command
7+
Facter::Core::Execution.execute('env PATH=$PATH:/usr/libexec mysqld --no-defaults -V 2>/dev/null')
78
end
89
end

‎manifests/backup/xtrabackup.pp

Lines changed: 48 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -49,26 +49,63 @@
4949
password_hash => mysql::password($backuppassword),
5050
require => Class['mysql::server::root_password'],
5151
}
52-
53-
if ($facts['os']['name'] == 'Debian' and versioncmp($facts['os']['release']['major'], '11') >= 0) or
54-
($facts['os']['name'] == 'Ubuntu' and versioncmp($facts['os']['release']['major'], '22.04') >= 0) {
55-
mysql_grant { "${backupuser}@localhost/*.*":
52+
# Percona XtraBackup needs additional grants/privileges to work with MySQL 8
53+
if versioncmp($facts['mysql_version'], '8') >= 0 and !(/(?i:mariadb)/ in $facts['mysqld_version']) {
54+
if ($facts['os']['name'] == 'Debian' and versioncmp($facts['os']['release']['major'], '11') >= 0) or
55+
($facts['os']['name'] == 'Ubuntu' and versioncmp($facts['os']['release']['major'], '22.04') >= 0) {
56+
mysql_grant { "${backupuser}@localhost/*.*":
57+
ensure => $ensure,
58+
user => "${backupuser}@localhost",
59+
table => '*.*',
60+
privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES', 'BACKUP_ADMIN'],
61+
require => Mysql_user["${backupuser}@localhost"],
62+
}
63+
}
64+
else {
65+
mysql_grant { "${backupuser}@localhost/*.*":
66+
ensure => $ensure,
67+
user => "${backupuser}@localhost",
68+
table => '*.*',
69+
privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT', 'BACKUP_ADMIN'],
70+
require => Mysql_user["${backupuser}@localhost"],
71+
}
72+
}
73+
mysql_grant { "${backupuser}@localhost/performance_schema.keyring_component_status":
5674
ensure => $ensure,
5775
user => "${backupuser}@localhost",
58-
table => '*.*',
59-
privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES'],
76+
table => 'performance_schema.keyring_component_status',
77+
privileges => ['SELECT'],
6078
require => Mysql_user["${backupuser}@localhost"],
6179
}
62-
}
63-
else {
64-
mysql_grant { "${backupuser}@localhost/*.*":
80+
mysql_grant { "${backupuser}@localhost/performance_schema.log_status":
6581
ensure => $ensure,
6682
user => "${backupuser}@localhost",
67-
table => '*.*',
68-
privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT'],
83+
table => 'performance_schema.log_status',
84+
privileges => ['SELECT'],
6985
require => Mysql_user["${backupuser}@localhost"],
7086
}
7187
}
88+
else {
89+
if $facts['os']['family'] == 'debian' and $facts['os']['release']['major'] == '11' or
90+
($facts['os']['name'] == 'Ubuntu' and versioncmp($facts['os']['release']['major'], '22.04') >= 0) {
91+
mysql_grant { "${backupuser}@localhost/*.*":
92+
ensure => $ensure,
93+
user => "${backupuser}@localhost",
94+
table => '*.*',
95+
privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES'],
96+
require => Mysql_user["${backupuser}@localhost"],
97+
}
98+
}
99+
else {
100+
mysql_grant { "${backupuser}@localhost/*.*":
101+
ensure => $ensure,
102+
user => "${backupuser}@localhost",
103+
table => '*.*',
104+
privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT'],
105+
require => Mysql_user["${backupuser}@localhost"],
106+
}
107+
}
108+
}
72109
}
73110

74111
if $install_cron {

‎spec/classes/mysql_backup_xtrabackup_spec.rb

Lines changed: 66 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ class { 'mysql::server': }
1111
EOF
1212
end
1313
let(:facts) do
14-
facts.merge(root_home: '/root')
14+
facts.merge(root_home: '/root',
15+
mysql_version: '5.7',
16+
mysld_version: 'mysqld Ver 5.7.38 for Linux on x86_64 (MySQL Community Server - (GPL)')
1517
end
1618

1719
let(:default_params) do
@@ -115,6 +117,69 @@ class { 'mysql::server': }
115117
)
116118
.that_requires('Mysql_user[backupuser@localhost]')
117119
end
120+
121+
context 'with MySQL version 5.7' do
122+
let(:facts) do
123+
facts.merge(mysql_version: '5.7')
124+
end
125+
126+
it {
127+
is_expected.not_to contain_mysql_grant('backupuser@localhost/performance_schema.keyring_component_status')
128+
is_expected.not_to contain_mysql_grant('backupuser@localhost/performance_schema.log_status')
129+
is_expected.not_to contain_mysql_grant('backupuser@localhost/*.*')
130+
.with(
131+
ensure: 'present',
132+
user: 'backupuser@localhost',
133+
table: '*.*',
134+
privileges:
135+
['BACKUP_ADMIN'],
136+
)
137+
.that_requires('Mysql_user[backupuser@localhost]')
138+
}
139+
end
140+
141+
context 'with MySQL version 8.0' do
142+
let(:facts) do
143+
facts.merge(mysql_version: '8.0',
144+
mysld_version: 'mysqld Ver 8.0.28 for Linux on x86_64 (MySQL Community Server - GPL)')
145+
end
146+
147+
it {
148+
is_expected.to contain_mysql_grant('backupuser@localhost/*.*')
149+
.with(
150+
ensure: 'present',
151+
user: 'backupuser@localhost',
152+
table: '*.*',
153+
privileges:
154+
if (facts[:operatingsystem] == 'Debian' && Puppet::Util::Package.versioncmp(facts[:operatingsystemmajrelease], '11') >= 0) ||
155+
(facts[:operatingsystem] == 'Ubuntu' && Puppet::Util::Package.versioncmp(facts[:operatingsystemmajrelease], '22') >= 0)
156+
['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES', 'BACKUP_ADMIN']
157+
else
158+
['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT', 'BACKUP_ADMIN']
159+
end,
160+
)
161+
.that_requires('Mysql_user[backupuser@localhost]')
162+
is_expected.to contain_mysql_grant('backupuser@localhost/performance_schema.keyring_component_status')
163+
.with(
164+
ensure: 'present',
165+
user: 'backupuser@localhost',
166+
table: 'performance_schema.keyring_component_status',
167+
privileges:
168+
['SELECT'],
169+
)
170+
.that_requires('Mysql_user[backupuser@localhost]')
171+
172+
is_expected.to contain_mysql_grant('backupuser@localhost/performance_schema.log_status')
173+
.with(
174+
ensure: 'present',
175+
user: 'backupuser@localhost',
176+
table: 'performance_schema.log_status',
177+
privileges:
178+
['SELECT'],
179+
)
180+
.that_requires('Mysql_user[backupuser@localhost]')
181+
}
182+
end
118183
end
119184

120185
context 'with additional cron args' do

‎spec/unit/facter/mysqld_version_spec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
context 'with value' do
1212
before :each do
1313
allow(Facter::Core::Execution).to receive(:which).with('mysqld').and_return('/usr/sbin/mysqld')
14-
allow(Facter::Core::Execution).to receive(:execute).with('mysqld --no-defaults -V 2>/dev/null')
14+
allow(Facter::Core::Execution).to receive(:execute).with('env PATH=$PATH:/usr/libexec mysqld --no-defaults -V 2>/dev/null')
1515
.and_return('mysqld Ver 5.5.49-37.9 for Linux on x86_64 (Percona Server (GPL), Release 37.9, Revision efa0073)')
1616
end
1717
it {

0 commit comments

Comments
 (0)