Add TLS Support to Maxscale (#19)

Signed-off-by: SK Ali Arman <[email protected]>

Author: sheikh-arman

scripts/maxscale.sh

@@ -4,7 +4,7 @@ args="$@"
 echo "INFO" "Storing default config into /etc/maxscale/maxscale.cnf"
 
 mkdir -p /etc/maxscale/maxscale.cnf.d
-cat >>/etc/maxscale/maxscale.cnf <<EOL
+cat >/etc/maxscale/maxscale.cnf <<EOL
 [maxscale]
 threads=1
 log_debug=1
@@ -19,20 +19,30 @@ EOL
 #EOL
 #fi
 
-cat >>/etc/maxscale/maxscale.cnf.d/maxscale.cnf <<EOL
+cat >/etc/maxscale/maxscale.cnf.d/maxscale.cnf <<EOL
 # Auto-generated server list from environment
 EOL
 
 serverList=""
 # Split HOST_LIST into an array
 for ((i=1; i<=REPLICAS; i++)); do
   cat >> /etc/maxscale/maxscale.cnf.d/maxscale.cnf <<EOL
+
 [server$i]
 type=server
 address=$BASE_NAME-$((i - 1)).$GOVERNING_SERVICE_NAME.$POD_NAMESPACE.svc.cluster.local
 port=3306
 protocol=MariaDBBackend
 EOL
+  if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+    cat >>/etc/maxscale/maxscale.cnf.d/maxscale.cnf <<EOL
+ssl=true
+ssl_ca=/etc/ssl/maxscale/ca.crt
+ssl_cert=/etc/ssl/maxscale/tls.crt
+ssl_key=/etc/ssl/maxscale/tls.key
+EOL
+  fi
+
   if [[ -n "$serverList" ]]; then
       serverList+=","
   fi
@@ -41,6 +51,7 @@ done
 
 if [[ "${UI:-}" == "true" ]]; then
   cat >>/etc/maxscale/maxscale.cnf <<EOL
+
 admin_secure_gui=false
 # this enables external access to the REST API outside of localhost
 # review / modify for any public / non development environments
@@ -95,6 +106,14 @@ service=RW-Split-Router
 protocol=MariaDBClient
 port=3306
 EOL
+if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+  cat >>/etc/maxscale/maxscale.cnf.d/maxscale.cnf <<EOL
+ssl=true
+ssl_ca=/etc/ssl/maxscale/ca.crt
+ssl_cert=/etc/ssl/maxscale/tls.crt
+ssl_key=/etc/ssl/maxscale/tls.key
+EOL
+fi
 
 echo "INFO: MaxScale configuration files have been successfully created."
 IFS=' '

scripts/std-replication-setup.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-env | sort | grep "POD\|HOST\|NAME"
+env | sort | grep "POD\|HOST\|NAME\|SSL"
+
 args=$@
 NAMESPACE="$POD_NAMESPACE"
 USER="$MYSQL_ROOT_USERNAME"
@@ -60,6 +61,19 @@ function wait_for_mysqld_running() {
 }
 
 joining_for_first_time=1
+
+function alter_user(){
+      local mysql="$mysql_header --host=$localhost"
+      local ssl_require=""
+      local user="$1"
+      if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+        ssl_require="REQUIRE SSL"
+      else
+        ssl_require="REQUIRE NONE"
+      fi
+      retry 120 ${mysql} -N -e "SET SQL_LOG_BIN=0;ALTER USER '$user'@'%' $ssl_require;"
+}
+
 function create_replication_user() {
     # https://mariadb.com/kb/en/setting-up-replication/
     log "INFO" "Checking whether replication user exist or not......"
@@ -77,6 +91,7 @@ function create_replication_user() {
     else
         log "INFO" "Replication user exists. Skipping creating new one......."
     fi
+    alter_user "repl"
 }
 
 function create_maxscale_user() {
@@ -101,9 +116,10 @@ function create_maxscale_user() {
     else
         log "INFO" "Maxscale user exists. Skipping creating new one......."
     fi
+    alter_user "maxscale"
 }
 
-//TODO:
+#//TODO:
 #function create_maxscale_confsync_user() {
 #    log "INFO" "Checking whether maxscale user exist or not......"
 #    local mysql="$mysql_header --host=$localhost"
@@ -121,6 +137,7 @@ function create_maxscale_user() {
 #    fi
 #}
 
+
 function create_monitor_user() {
     log "INFO" "Checking whether monitor user exist or not......"
     local mysql="$mysql_header --host=$localhost"
@@ -146,6 +163,7 @@ function create_monitor_user() {
     else
         log "INFO" "Monitor user exists. Skipping creating new one......."
     fi
+    alter_user "monitor_user"
 }
 function bootstrap_cluster() {
     echo "this is master node"
@@ -154,13 +172,20 @@ function bootstrap_cluster() {
 }
 
 function join_to_master_by_current_pos() {
-    # member try to join into the existing group as old instance
+    # member try to join into the existing group as fresh install, datadir is clean and no backup is restored
     log "INFO" "The replica, ${report_host} is joining to master node ${master}..."
     local mysql="$mysql_header --host=$localhost"
     log "INFO" "Joining to master with gtid current_pos.."
     retry 20 ${mysql} -N -e "STOP SLAVE;"
     retry 20 ${mysql} -N -e "RESET SLAVE ALL;"
-    retry 20 ${mysql} -N -e "CHANGE MASTER TO MASTER_HOST='$master',MASTER_USER='repl',MASTER_PASSWORD='$MYSQL_ROOT_PASSWORD',MASTER_USE_GTID = current_pos;"
+    local ssl_options=""
+    if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+        ssl_options=", MASTER_SSL=1, MASTER_SSL_CA='/etc/mysql/certs/server/ca.crt'"
+        log "INFO" "Configuring replication with TLS enabled"
+    else
+        log "INFO" "Configuring replication without TLS"
+    fi
+    retry 20 ${mysql} -N -e "CHANGE MASTER TO MASTER_HOST='$master', MASTER_USER='repl', MASTER_PASSWORD='$MYSQL_ROOT_PASSWORD' $ssl_options, MASTER_USE_GTID=current_pos;"
     retry 20 ${mysql} -N -e "START SLAVE;"
     joining_for_first_time=0
     echo "end join to master node by gtid current_pos"
@@ -176,13 +201,18 @@ function join_to_master_by_slave_pos() {
     if [ $joining_for_first_time -eq 1 ]; then
       retry 20 ${mysql} -N -e "SET GLOBAL gtid_slave_pos = '$gtid';"
     fi
-    retry 20 ${mysql} -N -e "CHANGE MASTER TO MASTER_HOST='$master',MASTER_USER='repl',MASTER_PASSWORD='$MYSQL_ROOT_PASSWORD',MASTER_USE_GTID = slave_pos;"
+    if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+        ssl_options=", MASTER_SSL=1, MASTER_SSL_CA='/etc/mysql/certs/server/ca.crt'"
+        log "INFO" "Configuring replication with TLS enabled"
+    else
+        log "INFO" "Configuring replication without TLS"
+    fi
+    retry 20 ${mysql} -N -e "CHANGE MASTER TO MASTER_HOST='$master', MASTER_USER='repl', MASTER_PASSWORD='$MYSQL_ROOT_PASSWORD' $ssl_options, MASTER_USE_GTID=slave_pos;"
     retry 20 ${mysql} -N -e "START SLAVE;"
     joining_for_first_time=0
     echo "end join to master node by gtid slave_pos"
 }
 
-
 export pid
 function start_mysqld_in_background() {
     log "INFO" "Starting MySQL server with docker-entrypoint.sh mysqld $args..."
@@ -221,7 +251,12 @@ fi
 
 start_mysqld_in_background
 
-export mysql_header="mariadb -u ${USER} --port=3306"
+if [[ "${REQUIRE_SSL:-}" == "TRUE" ]]; then
+  export mysql_header="mariadb -u ${USER} --port=3306 --ssl-ca=/etc/mysql/certs/server/ca.crt  --ssl-cert=/etc/mysql/certs/server/tls.crt --ssl-key=/etc/mysql/certs/server/tls.key"
+else
+  export mysql_header="mariadb -u ${USER} --port=3306"
+fi
+
 export MYSQL_PWD=${PASSWORD}
 
 # wait for mysqld to be ready
@@ -288,16 +323,3 @@ while true; do
     wait $pid
 done
 
-
-
-
-
-
-
-
-
-
-
-
-
-