my-vault/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md

# XtraDB Cluster install

## requirement
### docker

### host

```hosts
10.194.64.102 gzii-db-3
10.194.64.103 gzii-db-4
10.194.64.104 gzii-app-2
```

### sysctl
```bash
modprobe br_netfilter
lsmod | grep br_netfilter
echo "br_netfilter" | sudo tee -a /etc/modules-load.d/br_netfilter.conf
sysctl -w net.bridge.bridge-nf-call-iptables=1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
```

### iptables
```bash
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 33060 -j ACCEPT
iptables -A INPUT -p tcp --dport 4567 -j ACCEPT
```


```bash
iptables-save > /etc/iptables/rules.v4
systemctl restart iptables
```

### firewalld

```bash
firewall-cmd --get-active-zones
```


```bash
firewall-cmd --zone=public --add-port=3306/tcp --permanent
firewall-cmd --zone=public --add-port=4567/tcp --permanent
firewall-cmd --zone=public --add-port=33060/tcp --permanent
firewall-cmd --zone=public --add-port=2379/tcp --permanent 
firewall-cmd --zone=public --add-port=4568/tcp --permanent 
firewall-cmd --zone=public --add-port=4444/tcp --permanent
firewall-cmd --zone=public --add-port=13306/tcp --permanent
firewall-cmd --zone=public --add-port=6032/tcp --permanent
firewall-cmd --reload

```

## cluster
## node 1 

### image
```bash
gunzip -c percorna.tgz | docker load
```
### ssl
```bash
mkdir /opt/percorna/config
```


```my.cnf
[client]
ssl-ca = /cert/ca.pem
ssl-cert = /cert/client-cert.pem
ssl-key = /cert/client-key.pem

[sst]
encrypt = 4
ssl-ca = /cert/ca.pem
ssl-cert = /cert/server-cert.pem
ssl-key = /cert/server-key.pem

[mysqld]
ssl-ca=/cert/ca.pem
ssl-cert=/cert/server-cert.pem
ssl-key=/cert/server-key.pem
skip_name_resolve
log-error = /var/lib/mysql/error.log
wsrep_provider_options="socket.ssl_cert=/cert/server-cert.pem;socket.ssl_key=/cert/server-key.pem;socket.ssl_ca=/cert/ca.pem"
```



### etcd
```bash
ETCD_HOST=10.192.64.102
docker run -d \
  --name etcd \
  --net host \
  -v /usr/share/ca-certificates/:/etc/ssl/certs \
  -p 4001:4001 -p 2380:2380 -p 2379:2379 \
  quay.io/coreos/etcd:v3.4.35 \
 /usr/local/bin/etcd \
  --name etcd0 \
  --advertise-client-urls=http://${ETCD_HOST}:2379,http://${ETCD_HOST}:4001 \
  --listen-client-urls=http://0.0.0.0:2379,http://0.0.0.0:4001 \
  --initial-advertise-peer-urls=http://${ETCD_HOST}:2380 \
  --listen-peer-urls=http://0.0.0.0:2380 \
  --initial-cluster-token=etcd-cluster-1 \
  --initial-cluster=etcd0=http://${ETCD_HOST}:2380 \
  --initial-cluster-state=new
```



### bootstrap


```bash
mkpasswd -l 16
```

root password:
```
wc97fjvDg:Ywgyad
```




gzii-db-3:
```bash
docker run -d \
  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
  -e CLUSTER_NAME=pxc-cluster1 \
  --name=gzii-db-3 \
  --net=host \
  -v ./cert:/cert \
  -v ./config:/etc/percona-xtradb-cluster.conf.d \
  -v ./data:/var/lib/mysql:rw \
  percona/percona-xtradb-cluster:8.4.0
```

gzii-db-4:
```bash
docker run -d \
  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
  -e CLUSTER_NAME=pxc-cluster1 \
  -e CLUSTER_JOIN=gzii-db-3 \
  --name=gzii-db-4 \
  --net=host \
  -v ./cert:/cert \
  -v ./config:/etc/percona-xtradb-cluster.conf.d \
  -v ./data:/var/lib/mysql:rw \
  percona/percona-xtradb-cluster:8.4.0
```


monitor pass:
```
0nz&lzDAxcxet5ta
```


```sql
CREATE USER 'monitor'@'%' IDENTIFIED BY 'monitor'; 
ALTER USER 'monitor'@'%' IDENTIFIED BY 'monitor'; 
GRANT SELECT, PROCESS, REPLICATION CLIENT ON *.* TO 'monitor'@'%'; 
FLUSH PRIVILEGES;
```


```sql
CREATE USER 'operator'@'%' IDENTIFIED BY 'operator';
GRANT SELECT, REPLICATION CLIENT ON *.* TO 'operator'@'%';
FLUSH PRIVILEGES;

```




```sql
INSERT INTO mysql_users (username, password, default_hostgroup, active) 
VALUES ('monitoring', '0nz&lzDAxcxet5ta', 0, 1);

```


```sql
INSERT INTO mysql_users (username, password, default_hostgroup) VALUES ('monitor', '0nz&lzDAxcxet5ta', 0);
LOAD MYSQL USERS TO RUNTIME;
SAVE MYSQL USERS TO DISK;

```


```bash
proxysql-admin --config-file=/var/lib/proxysql/proxysql-admin.cnf --enable
```