Charmed MySQL
- By Canonical Data Platform
- Cloud
Channel | Revision | Published | Runs on |
---|---|---|---|
8.0/stable | 151 | 20 Apr 2023 | |
8.0/candidate | 151 | 20 Apr 2023 | |
8.0/beta | 151 | 20 Apr 2023 | |
8.0/edge | 161 | 26 May 2023 |
juju deploy mysql --channel 8.0/stable
You will need Juju 2.9 to be able to run this command. Learn how to upgrade to Juju 2.9.
Deploy universal operators easily with Juju, the Universal Operator Lifecycle Manager.
Platform:
Enable Security in your MySQL deployment
This is part of the Charmed MySQL Tutorial. Please refer to this page for more information and the overview of the content.
Transport Layer Security (TLS)
TLS is used to encrypt data exchanged between two applications; it secures data transmitted over the network. Typically, enabling TLS within a highly available database, and between a highly available database and client/server applications, requires domain-specific knowledge and a high level of expertise. Fortunately, the domain-specific knowledge has been encoded into Charmed MySQL. This means (re-)configuring TLS on Charmed MySQL is readily available and requires minimal effort on your end.
Again, relations come in handy here as TLS is enabled via relations; i.e. by relating Charmed MySQL to the TLS Certificates Charm. The TLS Certificates Charm centralises TLS certificate management in a consistent manner and handles providing, requesting, and renewing TLS certificates.
Configure TLS
Before enabling TLS on Charmed MySQL we must first deploy the tls-certificates-operator
charm:
juju deploy tls-certificates-operator --config generate-self-signed-certificates="true" --config ca-common-name="Tutorial CA"
Wait until the tls-certificates-operator
is up and active, use juju status --watch 1s
to monitor the progress:
Model Controller Cloud/Region Version SLA Timestamp
tutorial overlord localhost/localhost 2.9.42 unsupported 00:40:42+01:00
App Version Status Scale Charm Channel Rev Exposed Message
mysql 8.0.32-0ubun... active 2 mysql 8.0/stable 147 no
tls-certificates-operator active 1 tls-certificates-operator stable 22 no
Unit Workload Agent Machine Public address Ports Message
mysql/0* active idle 0 10.234.188.135 Primary
mysql/1 active idle 1 10.234.188.214
tls-certificates-operator/1* active idle 6 10.234.188.19
Machine State Address Inst id Series AZ Message
0 started 10.234.188.135 juju-ff9064-0 jammy Running
1 started 10.234.188.214 juju-ff9064-1 jammy Running
6 started 10.234.188.19 juju-ff9064-6 focal Running
Note: this tutorial uses self-signed certificates; self-signed certificates should not be used in a production cluster.
To enable TLS on Charmed MySQL, relate the two applications:
juju relate mysql tls-certificates-operator
Add external TLS certificate
Use openssl
to connect to the MySQL and check the TLS certificate in use:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer
...
depth=1 C = US, CN = Tutorial CA
...
Congratulations! MySQL is now using TLS certificate generated by the external application tls-certificates-operator
.
Remove external TLS certificate
To remove the external TLS and return to the locally generate one, unrelate applications:
juju remove-relation mysql tls-certificates-operator
Check the TLS certificate in use:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer
The output should be similar to:
...
Issuer: CN = MySQL_Server_8.0.32_Auto_Generated_CA_Certificate
...
The Charmed MySQL application reverted to the certificate that was created locally during the MySQL server installation.
Help us improve this documentation
Most of this documentation can be collaboratively discussed and changed on the respective topic in the doc category of the Charmhub forum. See the documentation guidelines if you’d like to contribute.