Feature/external deployment replication

jobs/pxc-mysql/spec

@@ -57,6 +57,8 @@ provides:
   - port
   - pxc_enabled
   - mysql_version
+  - tls.client.ca
+
 - name: internal-mysql-database
   type: internal-database
 - name: mysql-backup-user-creds
@@ -67,15 +69,13 @@ provides:
   - mysql_socket
 
 properties:
-
   pxc_enabled:
     description: 'Used for disabling the job. Useful if co-locating the cf-mysql release mysql job and migrating'
     default: true
   disable_persistent_storage_safety_check:
     description: 'pre-start checks that /var/vcap/store is a persistent volume to prevent accidentally running the database on an ephemeral disk. This can be used to disable this check for test or bosh-lite situations'
     default: false
 
-
   # Admin Users
   admin_username:
     description: 'Username for the MySQL server admin user'
@@ -100,7 +100,9 @@ properties:
     default: 'mysql-backup'
   mysql_backup_password:
     description: 'Optional. Password for mysql-backup user'
-
+  mysql_backup_allowed_remote_hosts:
+    default: localhost
+    description: 'Optional. Host from where the backup user is allowed to connect. % for all remote hosts.'
   mysql_socket:
     description: Location of the mysql socket for connecting locally
     default: '/var/vcap/sys/run/pxc-mysql/mysqld.sock'
@@ -388,4 +390,4 @@ properties:
   kernel.vm.swappiness:
     description: "Configure Linux vm.swappiness"
     # https://docs.kernel.org/admin-guide/sysctl/vm.html#swappiness
-    # https://www.percona.com/blog/mysql-101-linux-tuning-for-mysql/
+    # https://www.percona.com/blog/mysql-101-linux-tuning-for-mysql/

jobs/pxc-mysql/templates/db_init.erb

@@ -22,13 +22,13 @@ DROP USER IF EXISTS '<%= p('admin_username') %>'@'<%= host %>';
   <%- end -%>
 DROP USER IF EXISTS 'roadmin'@'<%= host %>';
 
-<%- end -%>
-<%- if_p('mysql_backup_password') do |password| -%>
-CREATE USER IF NOT EXISTS '<%= p('mysql_backup_username') %>'@'localhost';
-ALTER USER '<%= p('mysql_backup_username') %>'@'localhost' IDENTIFIED WITH <%= p('engine_config.user_authentication_policy') %> BY '<%= password %>';
-GRANT RELOAD, LOCK TABLES, REPLICATION SLAVE, REPLICATION CLIENT, /*!80001 BACKUP_ADMIN,*/ PROCESS ON *.* to '<%= p('mysql_backup_username') %>'@'localhost';
-GRANT SELECT on performance_schema.keyring_component_status to '<%= p('mysql_backup_username') %>'@'localhost';
-GRANT SELECT ON performance_schema.log_status TO '<%= p('mysql_backup_username') %>'@'localhost';
+<%- end
+if_p('mysql_backup_password') do |password| -%>
+CREATE USER IF NOT EXISTS '<%= p('mysql_backup_username') %>'@'<%= p('mysql_backup_allowed_remote_hosts') %>';
+ALTER USER '<%= p('mysql_backup_username') %>'@'<%= p('mysql_backup_allowed_remote_hosts') %>' IDENTIFIED WITH <%= p('engine_config.user_authentication_policy') %> BY '<%= password %>';
+GRANT EVENT, RELOAD, LOCK TABLES, REPLICATION SLAVE, REPLICATION CLIENT, /*!80001 BACKUP_ADMIN,*/ PROCESS ON *.* to '<%= p('mysql_backup_username') %>'@'<%= p('mysql_backup_allowed_remote_hosts') %>';
+GRANT SELECT ON performance_schema.keyring_component_status to '<%= p('mysql_backup_username') %>'@'<%= p('mysql_backup_allowed_remote_hosts') %>';
+GRANT SELECT ON performance_schema.log_status TO '<%= p('mysql_backup_username') %>'@'<%= p('mysql_backup_allowed_remote_hosts') %>';
 
 <%- end -%>
 <%- hosts.each do |host| -%>

jobs/pxc-replicator/monit

@@ -0,0 +1,5 @@
+check process pxc-replicator
+  with pidfile /var/vcap/sys/run/bpm/pxc-replicator/pxc-replicator.pid
+  start program "/var/vcap/jobs/bpm/bin/bpm start pxc-replicator"
+  stop program "/var/vcap/jobs/bpm/bin/bpm stop pxc-replicator"
+  group vcap

jobs/pxc-replicator/spec

@@ -0,0 +1,72 @@
+---
+name: pxc-replicator
+
+templates:
+  bpm.yml.erb: config/bpm.yml
+  config/config.yml.erb: config/config.yml
+
+packages:
+- percona-xtradb-cluster-8.0
+- percona-xtradb-cluster-8.4
+- pxc-replicator
+
+consumes:
+- name: mysql-backup-user-creds
+  type: mysql-backup-user-creds
+  optional: true
+- name: source
+  type: mysql
+  optional: true
+- name: target
+  type: mysql
+  optional: true
+
+properties:
+  #SOURCE
+  source_admin_username:
+    description: |
+      this is here for compatibility with older deployments of the pxc-release.
+      If provided it will be used to create, authorize the `mysql-backup-user` on the source instance
+  source_admin_password:
+    description: |
+      this is here for compatibility with older deployments of the pxc-release.
+      If provided it will be used to create, authorize the `mysql-backup-user` on the source instance
+  mysql_backup_username:
+    description: 'a replication enabled user that exists on the source mysql. It requires permissions to do a full `mysqldump --all-databases --events --triggers --routines --single-transaction` of the source instance. If specified alongside source_admin_username && source_admin_password this user will automatically be generated and provided with the right permissions. '
+  mysql_backup_password:
+    description: 'password to use for connection to source instance. If specified alongside source_admin_username && source_admin_password this user will automatically be generated and provided with the right permissions.'
+
+  #SOURCE TLS/CONNECTION
+  source_tls.ca:
+    description: ca certificate in pem format to validate the source instance
+  source_host:
+    description: 'hostname of the source database instance'
+  source_port:
+    default: 3306
+
+  #TARGET
+  target_admin_username:
+    description: |
+      the admin user for the target of the replication. It will be used to connect and setup the replication
+      connection
+  target_admin_password:
+    description: |
+      the admin user for the target of the replication. It will be used to connect and setup the replication
+      connection
+  #TARGET TLS/CONNECTION
+  target_host:
+    description: 'hostname of the target database instance'
+  target_port:
+    default: 3306
+  target_tls.ca:
+    description: ca certificate in pem format to validate the target instance
+
+  #GENERAL
+  clean_expired_backups:
+    description: |
+      To setup replication, pxc replicator will run an initial sync that takes a backup via mysqldump of the source. Re-Syncing is necessary in some cases where the replication breaks in a way where the incoming transactions from the source do not cleanly apply.
+      Enabling this setting will cleanup "expired" backups once the contained GTID is too old to reconnect the target with the source. When multiple viable backups are cached, only the latest viable backup is kept.
+    default: true
+  mysql_version:
+    description: 'the version of mysql deployed for source and target. Both deployments should use the same version.'
+    default: 8.4

jobs/pxc-replicator/templates/bpm.yml.erb

@@ -0,0 +1,17 @@
+processes:
+- name: pxc-replicator
+  executable: /var/vcap/packages/pxc-replicator/bin/replicator
+  args:
+  - -config=/var/vcap/jobs/pxc-replicator/config/config.yml
+  - -data-dir=/var/vcap/data/pxc-replicator/data
+  - -dump-dir=/var/vcap/data/pxc-replicator/dumps
+  - -mysql-bin-path=/var/vcap/packages/percona-xtradb-cluster-<%= p('mysql_version') -%>/bin/
+  - -mysql-version=<%= p('mysql_version')  %>
+  additional_volumes:
+  - path: /var/vcap/data/pxc-replicator/data
+    writable: true
+  - path: /var/vcap/data/pxc-replicator/dumps
+    writable: true
+  - path: /var/vcap/data/pxc-mysql
+    mount_only: true
+    writable: true

jobs/pxc-replicator/templates/config/config.yml.erb

@@ -0,0 +1,83 @@
+<%-
+source_creds = {}
+fallback = true
+if_link('mysql-backup-user-creds') do |link|
+  link.if_p('mysql_backup_username','mysql_backup_password') do |user,pass|
+    source_creds = { 'username' => user, 'password' => pass }
+    fallback = false
+  end
+end
+if fallback
+  if_p('mysql_backup_username', 'mysql_backup_password') do |user,pass|
+    source_creds = { 'username' => user, 'password' => pass }
+  end
+end
+  if_p('source_admin_username', 'source_admin_password') do |user,pass|
+    source_creds["admin_username"] = user
+    source_creds["admin_password"] = pass
+  end
+-%>
+version: <%= p('mysql_version') %>
+source:
+  name: source
+<%-
+if_link('source') do |link|
+  tls = {}
+  link.if_p('tls.client.ca') do |val|
+   tls["ca"] = val
+  end.else do
+    if_p('source_tls.ca') do |val|
+     tls["ca"] = val
+    end
+  end
+-%>
+#link config
+  host: <%= link.address %>
+  port: <%= link.p('port') %>
+  version: <%= link.p('mysql_version') %>
+  creds: <%= JSON.dump(source_creds) %>
+  tls: <%= JSON.dump(tls) %>
+<%-
+end.else do
+-%>
+#manual config
+  host: <%= p('source_host') %>
+  port: <%= p('source_port') %>
+  version: <%= p('mysql_version') %>
+  creds: <%= JSON.dump(source_creds) %>
+  tls: <%= JSON.dump(tls) %>
+<%-
+end
+-%>
+#TARGET
+target:
+  name: target
+<%-
+target_creds = {
+  "admin_username" => p('target_admin_username'),
+  "admin_password" => p('target_admin_password'),
+}
+if_link('target') do |link|
+tls = {}
+link.if_p('tls.client.ca') do |ca|
+  tls["ca"] = ca
+end.else do
+  if_p("target_tls.ca") do |ca|
+    tls["ca"] = ca
+  end
+end
+-%>
+  version: <%= link.p('mysql_version') %>
+  host: localhost
+  port: <%= link.p('port') %>
+  creds: <%= JSON.dump(target_creds) %>
+  tls: <%= JSON.dump(tls) %>
+<%-
+end.else do
+-%>
+  host: <%= p('target_host') %>
+  port: <%= p('target_port') %>
+  version: <%= p('mysql_version') %>
+  creds: <%= JSON.dump(target_creds) %>
+  tls: <%= JSON.dump(tls) %>
+<%- end -%>

operations/add-replicator-job.yml

@@ -0,0 +1,9 @@
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-replicator?
+  value:
+    name: pxc-replicator
+    release: pxc
+    properties: {}
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/engine_config?/binlog?/enable_gtid_mode?
+  value: true

operations/set-replicator-source.yml

@@ -0,0 +1,34 @@
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/engine_config?/server_id?
+  value: 1
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/engine_config?/binlog?/enable_gtid_mode
+  value: true
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/provides?
+  value:
+    mysql-backup-user-creds:
+      as: source-creds
+      shared: true
+    mysql:
+      as: replica-source
+      shared: true
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/mysql_backup_username?
+  value: ((mysql_backup_user.username))
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/mysql_backup_password?
+  value: ((mysql_backup_user.password))
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/mysql_backup_allowed_remote_hosts?
+  value: '%'
+
+- type: replace
+  path: /variables/name=mysql_backup_user?
+  value:
+    name: mysql_backup_user
+    type: user
+    parameters:
+      length: 32
+
+

operations/set-replicator-target.yml

@@ -0,0 +1,37 @@
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/engine_config?/server_id?
+  value: 2
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/engine_config?/binlog?/enable_gtid_mode?
+  value: true
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/provides?/mysql?
+  value:
+    as: replica-target
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/mysql_version?
+  value: '8.4'
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-replicator/properties/mysql_version?
+  value: '8.4'
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-replicator/properties/target_admin_username?
+  value: 'root'
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-replicator/properties/target_admin_password?
+  value: ((cf_mysql_mysql_admin_password))
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/tls?/client?/ca
+  value: ((mysql_server_certificate.ca))
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-replicator/consumes?
+  value:
+    source:
+      from: replica-source
+      deployment: ((source_deployment_name))
+    target:
+      from:
+        replica-target
+    mysql-backup-user-creds:
+      from: source-creds
+      deployment: ((source_deployment_name))

operations/update-azs.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/azs?
+  value: ((azs))

operations/update-deployment-name.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /name
+  value: ((deployment_name))

operations/update-network.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/networks?
+  value: [{name: ((network_name))}]

operations/update-persistent-disk-size.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/persistent_disk?
+  value: ((persistent_disk_size))

operations/update-vm-extensions.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/vm_extensions?
+  value: ((vm_extensions))

operations/update-vm-type.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/vm_type?
+  value: ((vm_type))

operations/use-mysql-8.4.yml

@@ -0,0 +1,3 @@
+- type: replace
+  path: /instance_groups/name=mysql/jobs/name=pxc-mysql/properties/mysql_version?
+  value: "8.4"

packages/pxc-replicator/packaging

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -ex
+
+source /var/vcap/packages/golang-1-linux/bosh/compile.env
+
+cd pxc-replicator
+  mkdir -p "${BOSH_INSTALL_TARGET}/bin"
+  GOOS=linux GOARCH=amd64 go build -mod=vendor -o "${BOSH_INSTALL_TARGET}/bin/replicator"
+cd -

packages/pxc-replicator/spec

@@ -0,0 +1,6 @@
+---
+name: pxc-replicator
+dependencies:
+- golang-1-linux
+files:
+- pxc-replicator/**/*