为什么ansible无法连接MySql？

Question

我想用这些配置部署一个 MySql 数据库服务器。

这是我部署 MySql 的手册：

- name: "Inclure le fichier : install_utilitaires_mysql.yaml"
  include: install_utilitaires_mysql.yaml
  when: ansible_os_family == "Debian"

- name: "Telechargement d'un package .deb pour ajouter le repo mysql"
  get_url:
    url: https://dev.mysql.com/get/mysql-apt-config_0.8.15-1_all.deb
    dest: /tmp
  when: ansible_os_family == "Debian"

- name: "Installation du package .deb"
  apt:
    deb: /tmp/mysql-apt-config_0.8.15-1_all.deb
  when: ansible_os_family == "Debian"

- name: "Mise a jour des sources list : apt update"
  apt:
   update_cache: yes
  when: ansible_os_family == "Debian"

- name: "Installation de MySql"
  apt:
    name: mysql-server
    state: latest
  when: ansible_os_family == "Debian"

- name: "Demarrer le service MySql"
  service:
    name: mysql
    state: started
    enabled: yes
  when: ansible_os_family == "Debian"

- name: "Voir la variable mysql_username"
  debug:
    msg: "{{ mysql_username }}"
  when: ansible_os_family == "Debian"

- name: "Création du user : {{ mysql_username }}"
  mysql_user:
    name: "{{ mysql_username }}"
    password: "{{ mysql_password }}"
    priv: '*.*:ALL'
    state: present
  when: ansible_os_family == "Debian"

但是当我使用ansible-playbook -i hosts playbook.yaml --vault-password-file password 命令执行这个剧本时，我会得到这个错误：

TASK [Création du user : {{ mysql_username }}] ********************************************************************************************************************************************************************
skipping: [192.168.1.41]
[WARNING]: Module did not set no_log for update_password
fatal: [192.168.1.37]: FAILED! => {"changed": false, "msg": "unable to connect to database, check login_user and login_password are correct or /root/.my.cnf has the credentials. Exception message: (1698, u\"Access denied for user 'root'@'localhost'\")"}

为什么 mysql -u root 可以正常工作时 ansible 无法连接到 MySQL？

我找到了这个解决方案，但我不明白它是如何工作的：

- name: Example using login_unix_socket to connect to server
  mysql_user:
    name: root
    password: root
    login_unix_socket: /var/run/mysqld/mysqld.sock
  when: ansible_os_family == "Debian"

首先思考

我找到了这段代码

---
- name: "Inclure le fichier : install_utilitaires_mysql.yaml"
  include: install_utilitaires_mysql.yaml
  when: ansible_os_family == "Debian"

- name: "Telechargement d'un package .deb pour ajouter le repo mysql"
  get_url:
    url: https://dev.mysql.com/get/mysql-apt-config_0.8.15-1_all.deb
    dest: /tmp
  when: ansible_os_family == "Debian"

- name: "Installation du package .deb"
  apt:
    deb: /tmp/mysql-apt-config_0.8.15-1_all.deb
  when: ansible_os_family == "Debian"

- name: "Mise a jour des sources list : apt update"
  apt:
   update_cache: yes
  when: ansible_os_family == "Debian"

- name: "Installation de MySql"
  apt:
    name: mysql-server
    state: latest
  when: ansible_os_family == "Debian"

- name: "Demarrer le service MySql"
  service:
    name: mysql
    state: started
    enabled: yes
  when: ansible_os_family == "Debian"
  
- name: "Envoi du template .my.cnf dans ~"
  template:
    src: root_cnf.j2
    dest: ~/.my.cnf
    owner: root
    mode: 0600
  when: ansible_os_family == "Debian"

- name: "Redemarrer le service MySql"
  service:
    name: mysql
    state: restarted
    enabled: yes
  when: ansible_os_family == "Debian"

- name: "Création du user : {{ mysql_username }}"
  mysql_user:
    login_user: root
    login_password: root
    name: "{{ mysql_username }}"
    password: "{{ mysql_password }}"
    priv: '*.*:ALL'
    state: present
  when: ansible_os_family == "Debian"

但是当我执行这个ansible-playbook -i hosts playbook.yaml --vault-password-file password 命令时，我得到了这个错误：

TASK [Création du user : {{ mysql_username }}] ********************************************************************************************************************************************************************
skipping: [192.168.43.102]
[WARNING]: Module did not set no_log for update_password
fatal: [192.168.43.182]: FAILED! => {"changed": false, "msg": "unable to connect to database, check login_user and login_password are correct or /********/.my.cnf has the credentials. Exception message: (1698, u\"Access denied for user '********'@'localhost'\")"}

问题：为什么运行我的 playbook 会导致此错误？

知道root_cnf.j2 jinja2 文件包含这个配置：

[client]
user=root
password=root

Answer 1

正如您所写，您需要使用login_unix_socket: /var/run/mysqld/mysqld.sock（必要时替换套接字的路径），因为无密码登录只能使用套接字，而不是使用网络。

见this post on dba.stackexchange.com。

它基本上是一项安全功能，因此您不会意外地在 Internet 上公开对数据库的无密码访问。

你首先要做的是

- name: Set password for root user
  mysql_user:
    name: "root"
    password: "{{ mysql_password }}"
    priv: '*.*:ALL,GRANT'
    host: 'localhost'
    login_unix_socket: /var/run/mysqld/mysqld.sock
    state: present

这将为root 设置密码。之后，root 的网络登录将被启用。
之后，你想做这样的事情：

- name: Save root password in .my.cnf
  template:
    src: root_cnf.j2
    dest: /root/.my.cnf
    owner: root
    mode: '0600'

模板是这样的：

[client]
user=root
password={{ mysql_root_password }}

这会将您的密码输入/root/.my.cnf，这样您就可以在机器上使用mysql，而无需提供凭据（ansible 会选择它）。

然后你可以用这个添加用户：

- name: "Create mysql user {{ mysql_username }}"
  mysql_user:
    name: "{{ mysql_username }}"
    password: "{{ mysql_password }}"
    priv: '*.*:ALL'

这就是你想要的，我猜。