-
Notifications
You must be signed in to change notification settings - Fork 204
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
faq: reorg advanced section, minor edits to main FAQ page
Signed-off-by: deepthi <[email protected]>
- Loading branch information
Showing
11 changed files
with
53 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
...ocs/faq/advanced-configurations/_index.md → ...docs/faq/advanced-configuration/_index.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 changes: 9 additions & 7 deletions
16
...advanced-configurations/authentication.md → .../advanced-configuration/authentication.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,28 +1,30 @@ | ||
--- | ||
title: Authentication | ||
description: Frequently Asked Questions about Vitess | ||
weight: 5 | ||
weight: 1 | ||
--- | ||
|
||
## How do I set up MySQL authentication in Vitess? | ||
|
||
Vitess uses its own mechanism for managing users and their permissions through VTGate. As a result, the CREATE USER.... and GRANT... statements will not work if sent through VTGate. Instead VTGate takes care of authentication for requests, so you will need to add any users that should have access to the Keyspaces via command-line options to VTGate. | ||
|
||
The simplest way to configure users is via a static authentication method. You can define the users in a JSON formatted file or string. Then you can load this static method into VTGate with the additional command line parameters. | ||
The simplest way to configure users is via a static authentication method. You can define the users in a JSON formatted file or string. Then you can load this file into VTGate with the additional command line parameters. | ||
|
||
You will be able to configure the UserData string and add multiple passwords. For password format, Vitess supports the MySQL mysql_native_password hash format and you should always specify your passwords using this in a non-test or external environment. | ||
You will be able to configure the UserData string and add multiple passwords. For password format, Vitess supports the mysql_native_password hash format and you should always specify your passwords using this in a non-test or external environment. | ||
|
||
To see an example of how to configure the static authentication file and more information on the various options please follow this [link](https://vitess.io/docs/user-guides/configuration-advanced/user-management/#authentication). | ||
To see an example of how to configure the static authentication file and more information on the various options please read this [guide](https://vitess.io/docs/user-guides/configuration-advanced/user-management/#authentication). | ||
|
||
There are other authentication mechanisms that can be utilized including LDAP-based authentication and TLS client certificate-based authentication. | ||
|
||
## How do I configure user-level permissions in Vitess? | ||
|
||
If you need to enforce fine-grained access control in Vitess, you cannot use the normal MySQL GRANTs system to give certain application-level MySQL users more or less permissions than others. This is because Vitess uses connection pooling with fixed MySQL users at the VTTablet level, and implements its own authentication at the VTGate level. | ||
If you need to enforce fine-grained access control in Vitess, you cannot use the normal MySQL GRANT system to give certain application-level MySQL users more or fewer permissions than others. This is because Vitess uses connection pooling with fixed MySQL users at the VTTablet level, and implements its own authentication at the VTGate level. | ||
|
||
Not all of the MySQL GRANT system has been implemented in Vitess. Authorization can be done via table-level ACLs. Individual users can be assigned 3 levels of permissions and can be applied on a specified set of tables, which can be enumerated or specified by regex: | ||
Not all of the MySQL GRANT system has been implemented in Vitess. Authorization can be done via table-level ACLs. Individual users at the VTGate level can be assigned 3 levels of permissions. | ||
- Read (corresponding to read DML, e.g. SELECT) | ||
- Write (corresponding to write DML, e.g. INSERT, UPDATE, DELETE) | ||
- Admin (corresponding to DDL, e.g. ALTER TABLE) | ||
|
||
Vitess authorization via ACLs are applied at the VTTablet level, as opposed to on VTGate, where authentication is enforced. There are a number of VTTablet command line parameters that control the behavior of ACLs. You can see examples and read more about the command line parameters and further configuration options [here](https://vitess.io/docs/user-guides/configuration-advanced/authorization/#vttablet-parameters-for-table-acls). | ||
The tables to which the permissions apply can be enumerated or specified using a regular expression. | ||
|
||
Vitess authorization via ACLs is applied at the VTTablet level, as opposed to on VTGate, where authentication is enforced. There are a number of VTTablet command line parameters that control the behavior of ACLs. You can see examples and read more about the command line parameters and further configuration options [here](https://vitess.io/docs/user-guides/configuration-advanced/authorization/#vttablet-parameters-for-table-acls). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
--- | ||
title: Components | ||
description: Frequently Asked Questions about Vitess | ||
weight: 2 | ||
--- | ||
|
||
## How can I change MySQL server variables in Vitess? | ||
|
||
In general, if you want to apply global variables at the MySQL level, you have to do it through VTTablet. There are a few ways to do that in the operator, but we recommend that you use vtctldclient ExecuteFetchAsDba. | ||
|
||
For example if you want to temporarily switch `sync_binlog` off on the MySQL that is being managed by a tablet with alias `zone1-0000000100` you would perform the following: | ||
|
||
```sh | ||
$ vtctldclient -server localhost:15999 ExecuteFetchAsDba zone1-0000000100 "set global sync_binlog=0" | ||
``` | ||
|
||
This would show the following result after checking the variable: | ||
|
||
```sh | ||
$ vtctldclient -server localhost:15999 ExecuteFetchAsDba zone1-0000000100 "show variables like 'sync_binlog'"+---------------+-------+| Variable_name | Value |+---------------+-------+| sync_binlog | 0 |+---------------+-------+ | ||
``` | ||
|
||
## Examples of how to use Vitess components | ||
|
||
We have a couple of step through examples in Github [here](https://github.com/aquarapid/vitess_examples). Currently, these cover Operator Backup and Restore, Create Lookup Vindex, and VStream. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.