Kubernetes中的HAProxy连接galera集群

Question

我想从部署在 kubernetes 中的haproxy pod 连接 Galera 集群。

镜像的 Docker 文件。

FROM haproxy:2.3
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

haproxy.cfg文件

defaults
    log global
    mode tcp
    retries 10
    timeout client 10000
    timeout connect 100500
    timeout server 10000
frontend mysql-router-service
    bind *:6446
    mode tcp
    option tcplog
    default_backend galera_cluster_backend
# MySQL Cluster BE configuration
backend galera_cluster_backend
    mode tcp
    #option mysql-check user haproxy
    option tcp-check 
    balance source
    server mysql_cluster_01 192.168.1.2:3306  check weight 1
    server mysql_cluster_02 192.168.1.3:3306  check weight 1
    server mysql_cluster_03 192.168.1.4:3306  check weight 1

这里mysql-router-service 可能会产生误导，但我们使用它是因为它是早期的数据库连接服务。

Kubernetes 部署清单

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ha-proxy
  namespace: mysql-router
spec:
  replicas: 1 
  selector:
    matchLabels:
      app: ha-proxy
  template:
    metadata:
      labels:
        app: ha-proxy
        version: v1
    spec:
      imagePullSecrets:
      - name: dreg
      containers:
      - name: ha-proxy
        image: our-registry:5000/haproxy:v14
        imagePullPolicy: Always
        ports:
        - containerPort: 6446

Kubernetes 服务清单：

apiVersion: v1
kind: Service
metadata:
  name: mysql-router-service
  namespace: mysql-router
  labels:
    app: ha-proxy
spec:
  selector:
    app: ha-proxy
    version: v1
  ports:
  - name: ha-proxy
    port: 6446
    protocol: TCP
    targetPort: 6446
  type: LoadBalancer
  loadBalancerIP: 192.168.1.101

在ha-proxy pod 日志中看到以下内容

[WARNING] 237/114804 (1) : config : log format ignored for frontend 'mysql-router-service' since it has no log address.
[NOTICE] 237/114804 (1) : New worker #1 (8) forked

如果我们在配置文件中使用option mysql-check user haproxy，Galera 日志/var/log/mysql/error.log 有

[Warning] Access denied for user 'haproxy'@'192.168.1.10' (using password NO)

这里192.168.1.10是k8 worker之一。

在 galera 集群中，我们有以下用户

+---------------+-------------+
| Host          | User        |
+---------------+-------------+    
| 192.168.1.%   | haproxy     |  
| localhost     | mariadb.sys |
| localhost     | mysql       |
| localhost     | root        |
+---------------+-------------+

所有节点都在运行Ubuntu 18-04，ufw 被禁用。

我们可以从 k8 worker telnet 到 galera 节点。 (telnet192.168.1.2 3306)

我们在这里错过了什么？

Answer 1

取决于：

[Warning] Access denied for user 'haproxy'@'192.168.1.10' (using password NO)

我认为您必须为用户设置密码：haproxy。