- By Canonical Data Platform
|8.0/stable||151||20 Apr 2023|
|8.0/candidate||151||20 Apr 2023|
|8.0/beta||151||20 Apr 2023|
|8.0/edge||161||26 May 2023|
juju deploy mysql --channel 8.0/stable
You will need Juju 2.9 to be able to run this command. Learn how to upgrade to Juju 2.9.
Deploy universal operators easily with Juju, the Universal Operator Lifecycle Manager.
Enable Security in your MySQL deployment
This is part of the Charmed MySQL Tutorial. Please refer to this page for more information and the overview of the content.
Transport Layer Security (TLS)
TLS is used to encrypt data exchanged between two applications; it secures data transmitted over the network. Typically, enabling TLS within a highly available database, and between a highly available database and client/server applications, requires domain-specific knowledge and a high level of expertise. Fortunately, the domain-specific knowledge has been encoded into Charmed MySQL. This means (re-)configuring TLS on Charmed MySQL is readily available and requires minimal effort on your end.
Again, relations come in handy here as TLS is enabled via relations; i.e. by relating Charmed MySQL to the TLS Certificates Charm. The TLS Certificates Charm centralises TLS certificate management in a consistent manner and handles providing, requesting, and renewing TLS certificates.
Before enabling TLS on Charmed MySQL we must first deploy the
juju deploy tls-certificates-operator --config generate-self-signed-certificates="true" --config ca-common-name="Tutorial CA"
Wait until the
tls-certificates-operator is up and active, use
juju status --watch 1s to monitor the progress:
Model Controller Cloud/Region Version SLA Timestamp tutorial overlord localhost/localhost 2.9.42 unsupported 00:40:42+01:00 App Version Status Scale Charm Channel Rev Exposed Message mysql 8.0.32-0ubun... active 2 mysql 8.0/stable 147 no tls-certificates-operator active 1 tls-certificates-operator stable 22 no Unit Workload Agent Machine Public address Ports Message mysql/0* active idle 0 10.234.188.135 Primary mysql/1 active idle 1 10.234.188.214 tls-certificates-operator/1* active idle 6 10.234.188.19 Machine State Address Inst id Series AZ Message 0 started 10.234.188.135 juju-ff9064-0 jammy Running 1 started 10.234.188.214 juju-ff9064-1 jammy Running 6 started 10.234.188.19 juju-ff9064-6 focal Running
Note: this tutorial uses self-signed certificates; self-signed certificates should not be used in a production cluster.
To enable TLS on Charmed MySQL, relate the two applications:
juju relate mysql tls-certificates-operator
Add external TLS certificate
openssl to connect to the MySQL and check the TLS certificate in use:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer ... depth=1 C = US, CN = Tutorial CA ...
Congratulations! MySQL is now using TLS certificate generated by the external application
Remove external TLS certificate
To remove the external TLS and return to the locally generate one, unrelate applications:
juju remove-relation mysql tls-certificates-operator
Check the TLS certificate in use:
> openssl s_client -starttls mysql -connect 10.234.188.135:3306 | grep Issuer
The output should be similar to:
... Issuer: CN = MySQL_Server_8.0.32_Auto_Generated_CA_Certificate ...
The Charmed MySQL application reverted to the certificate that was created locally during the MySQL server installation.
Help us improve this documentation
Most of this documentation can be collaboratively discussed and changed on the respective topic in the doc category of the Charmhub forum. See the documentation guidelines if you’d like to contribute.