Skip to content

feat(mysql): add optional authPlugin parameter for MySQL user creation #212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

ymaniukevich
Copy link

@ymaniukevich ymaniukevich commented Feb 9, 2025

Description of your changes

This pull request adds the ability to specify an authentication plugin when creating MySQL users. This enhancement allows users to define which authentication method should be used, providing greater flexibility and compatibility with various MySQL setups.
Supported Authentication Plugins: mysql_native_password, caching_sha2_password, AWSAuthenticationPlugin.

Fixes #106

I have:

  • Read and followed Crossplane's [contribution process].
  • Run make reviewable to ensure this PR is ready for review.

How has this code been tested

make build
make reviewable
make e2e

I built and tested the package locally using the following resources as well .

apiVersion: mysql.sql.crossplane.io/v1alpha1
kind: User
metadata:
  name: we1
spec:
  forProvider:
    resourceOptions:
      maxQueriesPerHour: 1000
      maxUpdatesPerHour: 1000
      maxConnectionsPerHour: 100
      maxUserConnections: 10
  writeConnectionSecretToRef:
    name: we1
    namespace: default
---
apiVersion: mysql.sql.crossplane.io/v1alpha1
kind: User
metadata:
  name: we2
spec:
  forProvider:
    authPlugin: caching_sha2_password
  writeConnectionSecretToRef:
    name: we2
    namespace: default
---
apiVersion: mysql.sql.crossplane.io/v1alpha1
kind: User
metadata:
  name: we3
spec:
  forProvider:
    authPlugin: AWSAuthenticationPlugin
  writeConnectionSecretToRef:
    name: we3
    namespace: default

@alekseikurepin
Copy link

So this functionality not implemented yet :(
We have many warning messages like this:
[Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
Will be waiting for proper review and release.

Thanks,

query := fmt.Sprintf(
"CREATE USER %s@%s IDENTIFIED BY %s%s",
"CREATE USER %s@%s IDENTIFIED %s%s",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know if it works to use xsql.Query here, this would use parameterized queries and reduce the likelyhood of any issues due to quoting.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m not sure, haven’t tried using xsql.Query in this context.

@chlunde
Copy link
Collaborator

chlunde commented May 27, 2025

@ymaniukevich could you rebase? I don't see any button to run CI here, usually there's a button to approve CI for first time contributors

@alekseikurepin would you be able to test this in your environment when we get a build?

@chlunde chlunde linked an issue May 27, 2025 that may be closed by this pull request
@chlunde
Copy link
Collaborator

chlunde commented May 27, 2025

Issue: #125

Duplicate PRs: #133 #186 #212

I think we need to look at the three implementations we have for this, and consider which one to move forward with. What ideas/uses cases are covered or not covered in each.

@ymaniukevich
Copy link
Author

@ymaniukevich could you rebase? I don't see any button to run CI here, usually there's a button to approve CI for first time contributors

Sure, I've done it

Issue: #125
Duplicate PRs: #133 #186 #212
I think we need to look at the three implementations we have for this, and consider which one to move forward with. What ideas/uses cases are covered or not covered in each.

While working on my implementation, I reviewed PR #186 and ensured that my changes cover the same use case.
It is quite difficult to cover all possible plugins, as they generate different SQL queries, but adding a new auth plugin is easy, by introducing an additional case

@ymaniukevich ymaniukevich force-pushed the master branch 3 times, most recently from 35a2179 to bda9267 Compare June 2, 2025 08:21
Signed-off-by: ymaniukevich <[email protected]>
@alekseikurepin
Copy link

@chlunde sorry, cannot upgrade current "provider-sql" from version 0.9.0 on staging environment, take time.

@chlunde
Copy link
Collaborator

chlunde commented Jun 16, 2025

@ymaniukevich I researched this issue quite a bit this weekend. I think #133 is a more complete approach, as it will support any plugin, and there are many. Additionally it supports changing the plugin/auth method, unlike this feature.

Another complicating factor is differences in supported plugins, even default plugin, for mariadb vs msql, and differences in syntax.

But we can keep this issue open until we see that #133 is mergeable. This is a much simpler approach.

Regardless of the outcome, thanks a lot for this contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support Authentication Plugins like authentication_ldap_simple Support RDS IAM authentication
3 participants