vitess.io/vitess@v0.16.2/examples/operator/101_initial_cluster.yaml (about)

     1  # The following example is minimalist. The security policies
     2  # and resource specifications are not meant to be used in production.
     3  # Please refer to the operator documentation for recommendations on
     4  # production settings.
     5  apiVersion: planetscale.com/v2
     6  kind: VitessCluster
     7  metadata:
     8    name: example
     9  spec:
    10    images:
    11      vtctld: vitess/lite:v16.0.2
    12      vtadmin: vitess/vtadmin:v16.0.2
    13      vtgate: vitess/lite:v16.0.2
    14      vttablet: vitess/lite:v16.0.2
    15      vtbackup: vitess/lite:v16.0.2
    16      vtorc: vitess/lite:v16.0.2
    17      mysqld:
    18        mysql80Compatible: vitess/lite:v16.0.2
    19      mysqldExporter: prom/mysqld-exporter:v0.11.0
    20    cells:
    21    - name: zone1
    22      gateway:
    23        authentication:
    24          static:
    25            secret:
    26              name: example-cluster-config
    27              key: users.json
    28        replicas: 1
    29        resources:
    30          requests:
    31            cpu: 100m
    32            memory: 256Mi
    33          limits:
    34            memory: 256Mi
    35    vitessDashboard:
    36      cells:
    37      - zone1
    38      extraFlags:
    39        security_policy: read-only
    40      replicas: 1
    41      resources:
    42        limits:
    43          memory: 128Mi
    44        requests:
    45          cpu: 100m
    46          memory: 128Mi
    47    vtadmin:
    48      rbac:
    49        name: example-cluster-config
    50        key: rbac.yaml
    51      cells:
    52        - zone1
    53      apiAddresses:
    54        - http://localhost:14001
    55      replicas: 1
    56      readOnly: false
    57      apiResources:
    58        limits:
    59          memory: 128Mi
    60        requests:
    61          cpu: 100m
    62          memory: 128Mi
    63      webResources:
    64        limits:
    65          memory: 128Mi
    66        requests:
    67          cpu: 100m
    68          memory: 128Mi
    69  
    70    keyspaces:
    71    - name: commerce
    72      durabilityPolicy: none
    73      turndownPolicy: Immediate
    74      vitessOrchestrator:
    75        resources:
    76          limits:
    77            memory: 128Mi
    78          requests:
    79            cpu: 100m
    80            memory: 128Mi
    81        extraFlags:
    82          recovery-period-block-duration: 5s
    83      partitionings:
    84      - equal:
    85          parts: 1
    86          shardTemplate:
    87            databaseInitScriptSecret:
    88              name: example-cluster-config
    89              key: init_db.sql
    90            tabletPools:
    91            - cell: zone1
    92              type: replica
    93              replicas: 2
    94              vttablet:
    95                extraFlags:
    96                  db_charset: utf8mb4
    97                resources:
    98                  limits:
    99                    memory: 256Mi
   100                  requests:
   101                    cpu: 100m
   102                    memory: 256Mi
   103              mysqld:
   104                resources:
   105                  limits:
   106                    memory: 512Mi
   107                  requests:
   108                    cpu: 100m
   109                    memory: 512Mi
   110              dataVolumeClaimTemplate:
   111                accessModes: ["ReadWriteOnce"]
   112                resources:
   113                  requests:
   114                    storage: 10Gi
   115    updateStrategy:
   116      type: Immediate
   117  ---
   118  apiVersion: v1
   119  kind: Secret
   120  metadata:
   121    name: example-cluster-config
   122  type: Opaque
   123  stringData:
   124    users.json: |
   125      {
   126        "user": [{
   127          "UserData": "user",
   128          "Password": ""
   129        }]
   130      }
   131    init_db.sql: |
   132      # This file is executed immediately after mysql_install_db,
   133      # to initialize a fresh data directory.
   134  
   135      ###############################################################################
   136      # Equivalent of mysql_secure_installation
   137      ###############################################################################
   138  
   139      # Changes during the init db should not make it to the binlog.
   140      # They could potentially create errant transactions on replicas.
   141      SET sql_log_bin = 0;
   142      # Remove anonymous users.
   143      DELETE FROM mysql.user WHERE User = '';
   144  
   145      # Disable remote root access (only allow UNIX socket).
   146      DELETE FROM mysql.user WHERE User = 'root' AND Host != 'localhost';
   147  
   148      # Remove test database.
   149      DROP DATABASE IF EXISTS test;
   150  
   151      ###############################################################################
   152      # Vitess defaults
   153      ###############################################################################
   154  
   155      # Vitess-internal database.
   156      CREATE DATABASE IF NOT EXISTS _vt;
   157      # Note that definitions of local_metadata and shard_metadata should be the same
   158      # as in production which is defined in go/vt/mysqlctl/metadata_tables.go.
   159      CREATE TABLE IF NOT EXISTS _vt.local_metadata (
   160        name VARCHAR(255) NOT NULL,
   161        value VARCHAR(255) NOT NULL,
   162        db_name VARBINARY(255) NOT NULL,
   163        PRIMARY KEY (db_name, name)
   164        ) ENGINE=InnoDB;
   165      CREATE TABLE IF NOT EXISTS _vt.shard_metadata (
   166        name VARCHAR(255) NOT NULL,
   167        value MEDIUMBLOB NOT NULL,
   168        db_name VARBINARY(255) NOT NULL,
   169        PRIMARY KEY (db_name, name)
   170        ) ENGINE=InnoDB;
   171  
   172      # Admin user with all privileges.
   173      CREATE USER 'vt_dba'@'localhost';
   174      GRANT ALL ON *.* TO 'vt_dba'@'localhost';
   175      GRANT GRANT OPTION ON *.* TO 'vt_dba'@'localhost';
   176  
   177      # User for app traffic, with global read-write access.
   178      CREATE USER 'vt_app'@'localhost';
   179      GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,
   180        REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,
   181        LOCK TABLES, EXECUTE, REPLICATION CLIENT, CREATE VIEW,
   182        SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
   183        ON *.* TO 'vt_app'@'localhost';
   184  
   185      # User for app debug traffic, with global read access.
   186      CREATE USER 'vt_appdebug'@'localhost';
   187      GRANT SELECT, SHOW DATABASES, PROCESS ON *.* TO 'vt_appdebug'@'localhost';
   188  
   189      # User for administrative operations that need to be executed as non-SUPER.
   190      # Same permissions as vt_app here.
   191      CREATE USER 'vt_allprivs'@'localhost';
   192      GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,
   193        REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,
   194        LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,
   195        SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
   196        ON *.* TO 'vt_allprivs'@'localhost';
   197  
   198      # User for slave replication connections.
   199      # TODO: Should we set a password on this since it allows remote connections?
   200      CREATE USER 'vt_repl'@'%';
   201      GRANT REPLICATION SLAVE ON *.* TO 'vt_repl'@'%';
   202  
   203      # User for Vitess filtered replication (binlog player).
   204      # Same permissions as vt_app.
   205      CREATE USER 'vt_filtered'@'localhost';
   206      GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, PROCESS, FILE,
   207        REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES,
   208        LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW,
   209        SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER
   210        ON *.* TO 'vt_filtered'@'localhost';
   211  
   212      # User for Orchestrator (https://github.com/openark/orchestrator).
   213      # TODO: Reenable when the password is randomly generated.
   214      CREATE USER 'orc_client_user'@'%' IDENTIFIED BY 'orc_client_user_password';
   215      GRANT SUPER, PROCESS, REPLICATION SLAVE, RELOAD
   216        ON *.* TO 'orc_client_user'@'%';
   217      GRANT SELECT
   218        ON _vt.* TO 'orc_client_user'@'%';
   219  
   220      FLUSH PRIVILEGES;
   221  
   222      RESET SLAVE ALL;
   223      RESET MASTER;
   224    rbac.yaml: |
   225      rules:
   226      - resource: "*"
   227        actions:
   228          - "get"
   229          - "create"
   230          - "put"
   231          - "ping"
   232        subjects: ["*"]
   233        clusters: ["*"]
   234      - resource: "Shard"
   235        actions:
   236          - "emergency_failover_shard"
   237          - "planned_failover_shard"
   238        subjects: ["*"]
   239        clusters: ["*"]