my-vault/01_Projects/Work/Government-Projects/Industry-Info/PERCONA XTRADB CLUSTER.md

XtraDB Cluster install

requirement

docker

host

10.194.64.102 gzii-db-3
10.194.64.103 gzii-db-4
10.194.64.104 gzii-app-2

sysctl

modprobe br_netfilter
lsmod | grep br_netfilter
echo "br_netfilter" | sudo tee -a /etc/modules-load.d/br_netfilter.conf
sysctl -w net.bridge.bridge-nf-call-iptables=1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1

iptables

iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 33060 -j ACCEPT
iptables -A INPUT -p tcp --dport 4567 -j ACCEPT

iptables-save > /etc/iptables/rules.v4
systemctl restart iptables

firewalld

firewall-cmd --get-active-zones

firewall-cmd --zone=public --add-port=3306/tcp --permanent
firewall-cmd --zone=public --add-port=4567/tcp --permanent
firewall-cmd --zone=public --add-port=33060/tcp --permanent
firewall-cmd --zone=public --add-port=2379/tcp --permanent 
firewall-cmd --zone=public --add-port=4568/tcp --permanent 
firewall-cmd --zone=public --add-port=4444/tcp --permanent
firewall-cmd --zone=public --add-port=13306/tcp --permanent
firewall-cmd --zone=public --add-port=6032/tcp --permanent
firewall-cmd --reload

cluster

node 1

image

gunzip -c percorna.tgz | docker load

ssl

mkdir /opt/percorna/config

[client]
ssl-ca = /cert/ca.pem
ssl-cert = /cert/client-cert.pem
ssl-key = /cert/client-key.pem

[sst]
encrypt = 4
ssl-ca = /cert/ca.pem
ssl-cert = /cert/server-cert.pem
ssl-key = /cert/server-key.pem

[mysqld]
ssl-ca=/cert/ca.pem
ssl-cert=/cert/server-cert.pem
ssl-key=/cert/server-key.pem
skip_name_resolve
log-error = /var/lib/mysql/error.log
wsrep_provider_options="socket.ssl_cert=/cert/server-cert.pem;socket.ssl_key=/cert/server-key.pem;socket.ssl_ca=/cert/ca.pem"

etcd

ETCD_HOST=10.192.64.102
docker run -d \
  --name etcd \
  --net host \
  -v /usr/share/ca-certificates/:/etc/ssl/certs \
  -p 4001:4001 -p 2380:2380 -p 2379:2379 \
  quay.io/coreos/etcd:v3.4.35 \
 /usr/local/bin/etcd \
  --name etcd0 \
  --advertise-client-urls=http://${ETCD_HOST}:2379,http://${ETCD_HOST}:4001 \
  --listen-client-urls=http://0.0.0.0:2379,http://0.0.0.0:4001 \
  --initial-advertise-peer-urls=http://${ETCD_HOST}:2380 \
  --listen-peer-urls=http://0.0.0.0:2380 \
  --initial-cluster-token=etcd-cluster-1 \
  --initial-cluster=etcd0=http://${ETCD_HOST}:2380 \
  --initial-cluster-state=new

bootstrap

mkpasswd -l 16

root password:

wc97fjvDg:Ywgyad

gzii-db-3:

docker run -d \
  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
  -e CLUSTER_NAME=pxc-cluster1 \
  --name=gzii-db-3 \
  --net=host \
  -v ./cert:/cert \
  -v ./config:/etc/percona-xtradb-cluster.conf.d \
  -v ./data:/var/lib/mysql:rw \
  percona/percona-xtradb-cluster:8.4.0

gzii-db-4:

docker run -d \
  -e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
  -e CLUSTER_NAME=pxc-cluster1 \
  -e CLUSTER_JOIN=gzii-db-3 \
  --name=gzii-db-4 \
  --net=host \
  -v ./cert:/cert \
  -v ./config:/etc/percona-xtradb-cluster.conf.d \
  -v ./data:/var/lib/mysql:rw \
  percona/percona-xtradb-cluster:8.4.0

monitor pass:

0nz&lzDAxcxet5ta

CREATE USER 'monitor'@'%' IDENTIFIED BY 'monitor'; 
ALTER USER 'monitor'@'%' IDENTIFIED BY 'monitor'; 
GRANT SELECT, PROCESS, REPLICATION CLIENT ON *.* TO 'monitor'@'%'; 
FLUSH PRIVILEGES;

CREATE USER 'operator'@'%' IDENTIFIED BY 'operator';
GRANT SELECT, REPLICATION CLIENT ON *.* TO 'operator'@'%';
FLUSH PRIVILEGES;

INSERT INTO mysql_users (username, password, default_hostgroup, active) 
VALUES ('monitoring', '0nz&lzDAxcxet5ta', 0, 1);

INSERT INTO mysql_users (username, password, default_hostgroup) VALUES ('monitor', '0nz&lzDAxcxet5ta', 0);
LOAD MYSQL USERS TO RUNTIME;
SAVE MYSQL USERS TO DISK;

proxysql-admin --config-file=/var/lib/proxysql/proxysql-admin.cnf --enable