--- # Source: mysql-operator/crds/crd.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: innodbclusters.mysql.oracle.com spec: group: mysql.oracle.com versions: - name: v2 served: true storage: true schema: openAPIV3Schema: type: object required: ["spec"] properties: metadata: type: object properties: name: type: string maxLength: 40 spec: type: object required: ["secretName"] properties: secretName: type: string description: "Name of a generic type Secret containing root/default account password" tlsCASecretName: type: string description: "Name of a generic type Secret containing CA (ca.pem) and optional CRL (crl.pem) for SSL" tlsSecretName: type: string description: "Name of a TLS type Secret containing Server certificate and private key for SSL" tlsUseSelfSigned: type: boolean default: false description: "Enables use of self-signed TLS certificates, reducing or disabling TLS based security verifications" meb: type: object properties: tlsSecretName: type: string description: "Name of a Secret containing MySQL Enterprise Backup client certificate and private key" version: type: string pattern: '^\d+\.\d+\.\d+(-.+)?' description: "MySQL Server version" edition: type: string pattern: "^(community|enterprise)$" description: "MySQL Server Edition (community or enterprise)" imageRepository: type: string description: "Repository where images are pulled from; defaults to container-registry.oracle.com/mysql" imagePullPolicy: type: string description: "Defaults to Always, but set to IfNotPresent in deploy-operator.yaml when deploying Operator" imagePullSecrets: type: array items: type: object properties: name: type: string serviceAccountName: type: string baseServerId: type: integer minimum: 0 maximum: 4294967195 default: 1000 description: "Base value for MySQL server_id for instances in the cluster" datadirVolumeClaimTemplate: type: object x-kubernetes-preserve-unknown-fields: true description: "Template for a PersistentVolumeClaim, to be used as datadir" datadirPermissions: type: object properties: setRightsUsingInitContainer: type: boolean default: true description: "Whether to use an init container to set at start the DataDir permissions " fsGroupChangePolicy: type: string description: "Optional fsGroupChangePolicy value to be set in the pod security context. Some possible values are OnRootMismatch and Always. For more information check the official Kubernetes documentation" default: "" mycnf: type: string description: "Custom configuration additions for my.cnf" instances: type: integer minimum: 1 maximum: 9 default: 1 description: "Number of MySQL replica instances for the cluster" podSpec: type: object x-kubernetes-preserve-unknown-fields: true description: "Customization specification to be merged into the InnoDBCluster StatefulSet pod template. IMPORTANT: podSpec is regarded only during StatefulSet buildup and the operator neither checks the values in podSpec nor later watches for changes of this field. Thus if changes are made to this field the InnoDBCluster StatefulSet will not be updated" podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true keyring: type: object description: "Keyring specification" properties: kmip: type: object description: "Keyring 'KMIP' specification" required: ["configuration", "server"] properties: configuration: type: string default: "" description: "Name of a secret that contains TLS certificates" cacheKeys: type: boolean default: true description: "Whether the keys are cached by the MySQL Server in RAM in plaintext. If set to false the keys are decrypted on every access" server: type: string default: "" description: "Primary OKV Server host with port number in the format :" standbyServer: type: array default: [] description: "A list of standby servers in the format :" items: type: string file: type: object description: "Keyring 'File' specification" required: ["storage"] properties: fileName: type: string default: "mysql_keyring" description: "Path to the keyring file name inside the storage volume (will be prefixed by mount path)" readOnly: type: boolean default: false description: "Whether to open the keyring file in read-only mode" storage: type: object description : "Specification of the volume to be mounted where the keyring file resides" x-kubernetes-preserve-unknown-fields: true encryptedFile: type: object description: "Keyring 'Encrypted File' specification" required: ["storage", "password"] properties: fileName: type: string default: "mysql_keyring" description: "Path to the keyring file name inside the storage volume (will be prefixed by mount path)" readOnly: type: boolean default: false description: "Whether to open the keyring file in read-only mode" password: type: string description: "Name of a secret that contains password for the keyring in the key 'keyring_password'" storage: type: object description : "Specification of the volume to be mounted where the keyring file resides" x-kubernetes-preserve-unknown-fields: true oci: type: object description: "Keyring 'OCI' specification" required: ["user", "keySecret", "keyFingerprint", "tenancy"] properties: user: type: string description: "User identifier in the form of ocid1.user.oc1..." pattern: '^ocid1\.user\.' keySecret: type: string description: "A secret that contains the private key under the field 'privatekey'" keyFingerprint: type: string description: "Private key fingerprint" pattern: '([0-9a-f]{2}:){15}[0-9a-f]{2}$' tenancy: type: string description: "Tenancy identifier in the form ocid1.tenancy.oc1..." pattern: '^ocid1\.tenancy\.' compartment: type: string description: "Compartment identifier in the form ocid1.compartment.oc1..." pattern: '^ocid1\.compartment\.' virtualVault: type: string description: "Vault identifier in the form ocid1.vault.oc1..." pattern: '^ocid1\.vault\.' masterKey: type: string description: "Master key identified in the form ocid1.key.oc1..." pattern: '^ocid1\.key\.' endpoints: type: object description: "" properties: encryption: type: string description: "Encryption endpoint URI like {identifier}-crypto.kms.{region}.oraclecloud.com" management: type: string description: "Management endpoint URI like {identifier}-management.kms.{region}.oraclecloud.com" vaults: type: string description: "Vaults endpoint URI like vaults.{region}.oci.oraclecloud.com" secrets: type: string description: "Secrets endpoint URI like secrets.vaults.{region}.oci.oraclecloud.com" caCertificate: type: string description: "Secret that contains ca.crt field with CA certificate bundle file that the keyring_oci plugin uses for Oracle Cloud Infrastructure certificate verification" initDB: type: object properties: clusterSet: type: object required: ["targetUrl", "secretKeyRef"] properties: targetUrl: type: string description: "URL of a cluster, which is a ClusterSet to join to" rootUser: type: string default: "root" description: "User name used for setup" secretKeyRef: type: object required: ["name"] properties: name: type: string description: "Secret name with key 'rootPassword' storing the password for the user specified in rootUser" clone: type: object required: ["donorUrl", "secretKeyRef"] properties: donorUrl: type: string description: "URL of the cluster to clone from" rootUser: type: string default: "root" description: "User name used for cloning" secretKeyRef: type: object required: ["name"] properties: name: type: string description: "Secret name with key 'rootPassword' storing the password for the user specified in rootUser" dump: type: object required: ["storage"] properties: name: type: string description: "Name of the dump. Not used by the operator, but a descriptive hint for the cluster administrator" path: type: string description: "Path to the dump in the PVC. Use when specifying persistentVolumeClaim. Omit for ociObjectStorage, S3, or azure." options: type: object description: "A dictionary of key-value pairs passed directly to MySQL Shell's loadDump()" x-kubernetes-preserve-unknown-fields: true storage: type: object properties: ociObjectStorage: type: object required: ["bucketName", "prefix", "credentials"] properties: bucketName: type: string description: "Name of the OCI bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" credentials: type: string description: "Name of a Secret with data for accessing the bucket" s3: type: object required: ["bucketName", "prefix", "config"] properties: bucketName: type: string description: "Name of the S3 bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" config: type: string description: "Name of a Secret with S3 configuration and credentials" profile: type: string default: "" description: "Profile being used in configuration files" endpoint: type: string description: "Override endpoint URL" azure: type: object required: ["containerName", "prefix", "config"] properties: containerName: type: string description: "Name of the Azure BLOB Storage container where the dump is stored" prefix: type: string description: "Path in the container where the dump files are stored" config: type: string description: "Name of a Secret with Azure BLOB Storage configuration and credentials" persistentVolumeClaim: type: object description : "Specification of the PVC to be used. Used 'as is' in the cloning pod." x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true meb: type: object required: ["storage", "fullBackup"] properties: storage: type: object #oneOf: #- required: ["ociObjectStorage", "s3"] properties: ociObjectStorage: type: object description: "Restore from OCI ObjectStorage using an PAR" required: ["credentials"] properties: credentials: type: string description: "Secret Containing PAR Base URL under key parBaseUrl" s3: description: "S3 style storage" type: object required: ['region', 'bucket', 'objectKeyPrefix', 'credentials'] properties: region: type: string description: "S3 Region" bucket: type: string description: "S3 Bucket Name" objectKeyPrefix: type: string description: "S3 Object Key Prefix, this will be extended with the name of the actual backup" credentials: type: string description: "Name of a Secret holding iaccessKeyId and secretAccessKey properties" host: type: string description: "Override hostname for S3-compatible backends" fullBackup: type: string description: "Name of the full backup to restore" incrementalBackups: type: array description: "Incremental backups to apply on top of the fullBackup" items: type: string pitr: type: object description: "Point-in-time recovery using a backup file on top of fullBackup and optional incrementalBackups" required: ["backupFile"] properties: backupFile: type: string description: "Backup containing binary log to apply" binlogName: type: string description: "Basename of binlogs to use for PITR. Often this is the server_name of the backup source" end: type: object description: "End condition for not applying the full log" #oneOf: ['afterGtids', 'beforeGtids'] properties: afterGtids: type: string description: "GTID set describing last transactions to apply, see SQL_AFTER_GTIDS in CHANGE REPLICATION SOURCE statement documentation" beforeGtids: type: string description: "GTID set describing last transactions to apply, see SQL_BEFORE_GTID in CHANGE REPLICATION SOURCE statement documentation" extraOptions: description: "Additonal Command Line Options being passed to MySQL Enterprise Backup" type: array items: type: string x-kubernetes-preserve-unknown-fields: true router: type: object description: "MySQL Router specification" properties: instances: type: integer minimum: 0 default: 1 description: "Number of MySQL Router instances to deploy" tlsSecretName: type: string description: "Name of a TLS type Secret containing MySQL Router certificate and private key used for SSL" version: type: string pattern: '^\d+\.\d+\.\d+(-.+)?' description: "Override MySQL Router version" podSpec: type: object x-kubernetes-preserve-unknown-fields: true description: "Customization specification to be merged into the Router Deployment pod template. IMPORTANT: podSpec is regarded only during Deployment buildup and the operator neither checks the values in podSpec nor later watches for changes of this field. Thus if changes are made to this field the Router Deployment will not be updated" podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true bootstrapOptions: description: "Command line options passed to MySQL Router while bootstrapping" type: array items: type: string options: description: "Command line options passed to MySQL Router while running" type: array items: type: string routingOptions: description: "Set routing options for the cluster" type: object properties: # naming pattern follows Shell's naming documented at # https://dev.mysql.com/doc/mysql-shell/8.1/en/innodb-clusterset-router-setroutingoption.html # ClusterSet-related options and tags currently not supported invalidated_cluster_policy: type: string enum: ["drop_all", "accept_ro"] stats_updates_frequency: type: integer default: 0 minimum: 0 read_only_targets: type: string enum: ["all", "read_replicas", "secondaries"] instanceService: type: object description: "Configuration of the Service used by the InnoDB Cluster GR members internally" properties: annotations: type: object description: "Custom annotations for the Service" x-kubernetes-preserve-unknown-fields: true labels: type: object description: "Custom labels for the Service" x-kubernetes-preserve-unknown-fields: true service: type: object description: "Configuration of the Service used by applications connecting to the InnoDB Cluster" properties: type: type: string enum: ["ClusterIP", "NodePort", "LoadBalancer"] default: "ClusterIP" annotations: type: object description: "Custom annotations for the Service" x-kubernetes-preserve-unknown-fields: true labels: type: object description: "Custom labels for the Service" x-kubernetes-preserve-unknown-fields: true defaultPort: type: string description: "Target for the Service's default (3306) port. If mysql-rw traffic will go to the primary and allow read and write operations, with mysql-ro traffic goes to the replica and allows only read operations, with mysql-rw-split the router's read-write-splitting will be targeted" enum: ["mysql-rw", "mysql-ro", "mysql-rw-split"] default: "mysql-rw" metrics: type: object description: "Configuration of a Prometheus-style metrics provider" required: ["enable", "image"] properties: enable: type: boolean default: false description: "Toggle to enable or disable the metrics sidecar" image: type: string description: "Name of an image to be used for the metrics sidecar, if provided metrics will be enabled" options: type: array description: "Options passed to the metrics provider as command line arguments" items: type: string webConfig: type: string description: "Name of a ConfigMap with a web.config file, if this option is provided a command line option --web.config.file is added" tlsSecret: type: string description: "Name of a Secret with TLS certificate, key and CA, which will be mounted at /tls into the container an can be used from webConfig" monitor: type: boolean description: "Create a ServiceMonitor for Prometheus Operator" default: false monitorSpec: type: object x-kubernetes-preserve-unknown-fields: true description: "Custom configuration for the ServiceMonitor object" default: {} # These are only supported for development purpose: #dbUser: # type: object # description: "MySQL user accoutn to be used for collecting metrics" # properties: # name: # type: string # description: "The account name, host part will always be localhost" # default: mysqlmetrics # grants: # type: array # description: "GRANTs given to the account" # default: [ 'PROCESS', 'REPLICATION CLIENT', 'SELECT' ] # items: # type: string # maxConnections: # type: integer # default: 3 # description: "Maximum number of connections" backupProfiles: type: array description: "Backup profile specifications for the cluster, which can be referenced from backup schedules and one-off backup jobs" items: type: object required: ["name"] properties: name: type: string description: "Embedded backup profile, referenced as backupProfileName elsewhere" podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true dumpInstance: type: object properties: dumpOptions: type: object description: "A dictionary of key-value pairs passed directly to MySQL Shell's DumpInstance()" x-kubernetes-preserve-unknown-fields: true storage: type: object properties: ociObjectStorage: type: object required: ["bucketName", "credentials"] properties: bucketName: type: string description: "Name of the OCI bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" credentials: type: string description: "Name of a Secret with data for accessing the bucket" s3: type: object required: ["bucketName", "config"] properties: bucketName: type: string description: "Name of the S3 bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" config: type: string description: "Name of a Secret with S3 configuration and credentials" profile: type: string default: "" description: "Profile being used in configuration files" endpoint: type: string description: "Override endpoint URL" azure: type: object required: ["containerName", "config"] properties: containerName: type: string description: "Name of the Azure BLOB Storage container where the dump is stored" prefix: type: string description: "Path in the container where the dump files are stored" config: type: string description: "Name of a Secret with Azure BLOB Storage configuration and credentials" persistentVolumeClaim: type: object description : "Specification of the PVC to be used. Used 'as is' in pod executing the backup." x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true meb: type: object description: "MySQL Enterprise Backup" required: ["storage"] properties: storage: type: object description: "Configuration of storage for MySQL Enterprise Backup" properties: s3: description: "S3 style storage" type: object required: ['region', 'bucket', 'objectKeyPrefix', 'credentials'] properties: region: type: string description: "S3 Region" bucket: type: string description: "S3 Bucket Name" objectKeyPrefix: type: string description: "S3 Object Key Prefix, this will be extended with the name of the actual backup" credentials: type: string description: "Name of a Secret holding iaccessKeyId and secretAccessKey properties" host: type: string description: "Override hostname for S3-compatible backends" oci: type: object description: "Store MySQL Enterprise Backup on OCI Object Storage" required: ['bucketName', 'prefix', 'namespace', 'credentials'] properties: bucketName: type: string description: "Name of the OCI bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" namespace: type: string description: "OCI Namespace of Object Store" credentials: type: string description: "Name of a Secret with data for accessing the bucket" extraOptions: description: "Additonal Command Line Options being passed to MySQL Enterprise Backup" type: array items: type: string snapshot: type: object properties: storage: type: object properties: ociObjectStorage: type: object required: ["bucketName", "credentials"] properties: bucketName: type: string description: "Bucket name where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" credentials: type: string description: "Name of a Secret with data for accessing the bucket" s3: type: object required: ["bucketName", "config"] properties: bucketName: type: string description: "Name of the S3 bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" config: type: string description: "Name of a Secret with S3 configuration and credentials" profile: type: string default: "" description: "Profile being used in configuration files" endpoint: type: string description: "Override endpoint URL" azure: type: object required: ["containerName", "config"] properties: containerName: type: string description: "Name of the Azure BLOB Storage container where the dump is stored" prefix: type: string description: "Path in the container where the dump files are stored" config: type: string description: "Name of a Secret with Azure BLOB Storage configuration and credentials" persistentVolumeClaim: type: object description : "Specification of the PVC to be used. Used 'as is' in pod executing the backup." x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true backupSchedules: type: array description: "Schedules for periodically executed backups" items: type: object required: ["name", "schedule"] x-kubernetes-preserve-unknown-fields: true properties: name: type: string description: "Name of the backup schedule" schedule: type: string description: "The schedule of the job, syntax as a cron expression" backupProfileName: type: string description: "Name of the backupProfile to be used" backupProfile: type: object description: "backupProfile specification if backupProfileName is not specified" x-kubernetes-preserve-unknown-fields: true properties: podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true dumpInstance: type: object properties: dumpOptions: type: object description: "A dictionary of key-value pairs passed directly to MySQL Shell's DumpInstance()" x-kubernetes-preserve-unknown-fields: true storage: type: object properties: ociObjectStorage: type: object required: ["bucketName", "credentials"] properties: bucketName: type: string description: "Name of the OCI Bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" credentials: type: string description: "Name of a Secret with data for accessing the bucket" s3: type: object required: ["bucketName", "config"] properties: bucketName: type: string description: "Name of the S3 bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" config: type: string description: "Name of a Secret with S3 configuration and credentials" profile: type: string default: "" description: "Profile being used in configuration files" endpoint: type: string description: "Override endpoint URL" azure: type: object required: ["containerName", "config"] properties: containerName: type: string description: "Name of the Azure BLOB Storage container where the dump is stored" prefix: type: string description: "Path in the container where the dump files are stored" config: type: string description: "Name of a Secret with Azure BLOB Storage configuration and credentials" persistentVolumeClaim: type: object description : "Specification of the PVC to be used. Used 'as is' in pod executing the backup." x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true meb: type: object description: "MySQL Enterprise Backup" required: ["storage"] properties: storage: type: object description: "Configuration of storage for MySQL Enterprise Backup" properties: s3: description: "S3 style storage" type: object required: ['region', 'bucket', 'objectKeyPrefix', 'credentials'] properties: region: type: string description: "S3 Region" bucket: type: string description: "S3 Bucket Name" objectKeyPrefix: type: string description: "S3 Object Key Prefix, this will be extended with the name of the actual backup" credentials: type: string description: "Name of a Secret holding iaccessKeyId and secretAccessKey properties" host: type: string description: "Override hostname for S3-compatible backends" oci: type: object description: "Store MySQL Enterprise Backup on OCI Object Storage" required: ['bucketName', 'prefix', 'namespace', 'credentials'] properties: bucketName: type: string description: "Name of the OCI bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" namespace: type: string description: "OCI Namespace of Object Store" credentials: type: string description: "Name of a Secret with data for accessing the bucket" extraOptions: description: "Additonal Command Line Options being passed to MySQL Enterprise Backup" type: array items: type: string deleteBackupData: type: boolean default: false description: "Whether to delete the backup data in case the MySQLBackup object created by the job is deleted" enabled: type: boolean default: true description: "Whether the schedule is enabled or not" timeZone: type: string description: "Timezone for the backup schedule, example: 'America/New_York'" logs: type: object properties: general: type: object properties: enabled: type: boolean default: false description: "Whether general logging should be enabled" collect: type: boolean default: false description: "Whether general logging data should be collected. Implies that the logging should be enabled." error: type: object properties: collect: type: boolean default: false description: "Whether error logging data should be collected. Implies that the logging should be enabled. If enabled the error log will be switched to JSON format output" verbosity: type: integer default: 3 minimum: 1 maximum: 3 description: "Log error verbosity. For details, see the MySQL Server --log-error-verbosity documentation." slowQuery: type: object properties: enabled: type: boolean default: false description: "Whether slow query logging should be enabled" longQueryTime: type: number minimum: 0 default: 10 description: "Long query time threshold" collect: type: boolean default: false description: "Whether slow query logging data should be collected. Implies that the logging should be enabled." collector: type: object oneOf: - required: ["image", "fluentd"] properties: image: type: string description: "Name of an image, including registry and repository, to be used for the log collector sidecar. If provided it needs to be an image for the configured collector type." containerName: type: string default: "logcollector" description: "Name of the collector container sidecar" env: type: array items: type: object description: "Environment variables to be passed to the image. Definition will be directly copied like podSpec fields are" x-kubernetes-preserve-unknown-fields: true fluentd: type: object description: "Properties of the fluentd log collector" oneOf: - required: ["sinks"] properties: generalLog: type: object properties: tag: type: string default: "" description: "Tag for the general log records" options: type: object description: "fluentd specific options for the general log" x-kubernetes-preserve-unknown-fields: true errorLog: type: object properties: tag: type: string default: "" description: "Tag for the error log records" options: type: object description: "fluentd specific options for the error log" x-kubernetes-preserve-unknown-fields: true slowQueryLog: type: object properties: tag: type: string default: "" description: "Tag for the slow log records" options: type: object description: "fluentd specific options for the slow log" x-kubernetes-preserve-unknown-fields: true recordAugmentation: type: object properties: enabled: type: boolean default: false description: "Whether to enable record augmentation with additional data" labels: type: array items: type: object required: ["fieldName", "labelName"] properties: fieldName: type: string description: "Name of the field added to the log record with value from labelName" labelName: type: string description: "Name of the pod label that holds the value to be stored under fieldName in the log record" annotations: type: array items: type: object required: ["fieldName", "annotationName"] properties: fieldName: type: string description: "Name of the field added to the log record with value from annotationName" annotationName: type: string description: "Name of the pod label that holds the value to be stored under fieldName in the log record" staticFields: type: array items: type: object required: ["fieldName", "fieldValue"] properties: fieldName: type: string description: "Name of the field added to the log record with value from fieldValue" fieldValue: type: string description: "Value for the static field with name taken from fieldName" podFields: type: array items: type: object required: ["fieldName", "fieldPath"] properties: fieldName: type: string description: "Name of the field added to the log record with value taken from a field with path stored in fieldPath" fieldPath: type: string description: "Value for the field fieldName. The path should be of the same syntax as the one used for mounting environment variables from field reference - valueFrom.fieldRef.fieldPath . The field will be mounted in the pod as a environment variable, prefixed with a prefix and used then added to the log record. Examples for fieldRef are : spec.nodeName, metadata.namespace, status.podIP, etc." resourceFields: type: array items: type: object required: ["fieldName", "containerName", "resource"] properties: fieldName: type: string description: "Name of the field added to the log record with value taken from a field with path stored in fieldPath" containerName: type: string resource: type: string description: "See https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/#use-container-fields-as-values-for-environment-variables" additionalFilterConfiguration: type: string description: "Raw configuration of additional Fluentd filters to be added to the configuration file" sinks: type: array items: type: object required: ["name", "rawConfig"] x-kubernetes-preserve-unknown-fields: true properties: name: type: string description: "Name of the sink. Used only for documentation purposes" rawConfig: type: "string" description: "Raw configuration of the sink" readReplicas: type: array items: type: object required: ["name", "baseServerId"] properties: name: type: string version: type: string pattern: '^\d+\.\d+\.\d+(-.+)?' description: "MySQL Server version" baseServerId: type: integer minimum: 0 maximum: 4294967195 default: 0 description: "Base value for MySQL server_id for instances of the readReplica, if 0 it will be assigned automatically" datadirVolumeClaimTemplate: type: object x-kubernetes-preserve-unknown-fields: true description: "Template for a PersistentVolumeClaim, to be used as datadir" mycnf: type: string description: "Custom configuration additions for my.cnf" instances: type: integer minimum: 1 maximum: 999 default: 1 description: "Number of MySQL instances for the set of read replica" podSpec: type: object x-kubernetes-preserve-unknown-fields: true description: "Customization specification to be merged into the InnoDBCluster StatefulSet pod template. IMPORTANT: podSpec is regarded only during StatefulSet buildup and the operator neither checks the values in podSpec nor later watches for changes of this field. Thus if changes are made to this field the InnoDBCluster StatefulSet will not be updated" podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true serviceFqdnTemplate: type: string description: "Template for a FQDN resolving to the cluster's headless instance Service and individual Pods" #default: "{service}.{namespace}.svc.{domain}" - We can't set the default as that would override the environment value from the operator status: type: object x-kubernetes-preserve-unknown-fields: true subresources: status: {} additionalPrinterColumns: - name: Status type: string description: Status of the InnoDB Cluster jsonPath: .status.cluster.status - name: Online type: integer description: Number of ONLINE InnoDB Cluster instances jsonPath: .status.cluster.onlineInstances - name: Instances type: integer description: Number of InnoDB Cluster instances configured jsonPath: .spec.instances - name: Routers type: integer description: Number of Router instances configured for the InnoDB Cluster jsonPath: .spec.router.instances - name: Type type: string description: Type of the cluster in a ClusterSet (PRIMARY, REPLICA, UNKNOWN) jsonPath: .status.cluster.type - name: Age type: date jsonPath: .metadata.creationTimestamp scope: Namespaced names: kind: InnoDBCluster listKind: InnoDBClusterList singular: innodbcluster plural: innodbclusters shortNames: - ic - ics --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: mysqlbackups.mysql.oracle.com spec: group: mysql.oracle.com scope: Namespaced names: kind: MySQLBackup listKind: MySQLBackupList singular: mysqlbackup plural: mysqlbackups shortNames: - mbk versions: - name: v2 served: true storage: true schema: openAPIV3Schema: type: object properties: spec: type: object required: ["clusterName"] properties: clusterName: type: string backupProfileName: type: string backupProfile: type: object description: "backupProfile specification if backupProfileName is not specified" x-kubernetes-preserve-unknown-fields: true properties: podAnnotations: type: object x-kubernetes-preserve-unknown-fields: true podLabels: type: object x-kubernetes-preserve-unknown-fields: true dumpInstance: type: object properties: dumpOptions: type: object description: "A dictionary of key-value pairs passed directly to MySQL Shell's DumpInstance()" x-kubernetes-preserve-unknown-fields: true storage: type: object properties: ociObjectStorage: type: object required: ["bucketName", "credentials"] properties: bucketName: type: string description: "Name of the OCI bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" credentials: type: string description: "Name of a Secret with data for accessing the bucket" s3: type: object required: ["bucketName", "config"] properties: bucketName: type: string description: "Name of the S3 bucket where the dump is stored" prefix: type: string description: "Path in the bucket where the dump files are stored" config: type: string description: "Name of a Secret with S3 configuration and credentials" profile: type: string default: "" description: "Profile being used in configuration files" endpoint: type: string description: "Override endpoint URL" azure: type: object required: ["containerName", "config"] properties: containerName: type: string description: "Name of the Azure BLOB Storage container where the dump is stored" prefix: type: string description: "Path in the container where the dump files are stored" config: type: string description: "Name of a Secret with Azure BLOB Storage configuration and credentials" persistentVolumeClaim: type: object description : "Specification of the PVC to be used. Used 'as is' in pod executing the backup." x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true meb: type: object description: "MySQL Enterprise Backup" required: ["storage"] properties: storage: type: object description: "Configuration of storage for MySQL Enterprise Backup" properties: s3: description: "S3 style storage" type: object required: ['region', 'bucket', 'objectKeyPrefix', 'credentials'] properties: region: type: string description: "S3 Region" bucket: type: string description: "S3 Bucket Name" objectKeyPrefix: type: string description: "S3 Object Key Prefix, this will be extended with the name of the actual backup" credentials: type: string description: "Name of a Secret holding iaccessKeyId and secretAccessKey properties" host: type: string description: "Override hostname for S3-compatible backends" oci: type: object description: "Store MySQL Enterprise Backup on OCI Object Storage" required: ['bucketName', 'prefix', 'namespace', 'credentials'] properties: bucketName: type: string description: "Name of the OCI bucket where backup is stored" prefix: type: string description: "Path in bucket where backup is stored" namespace: type: string description: "OCI Namespace of Object Store" credentials: type: string description: "Name of a Secret with data for accessing the bucket" extraOptions: description: "Additonal Command Line Options being passed to MySQL Enterprise Backup" type: array items: type: string incremental: type: boolean default: false description: "MySQL Enterprise Backup only: Request taking an incremental backup" incrementalBase: type: string description: "MySQL Enterprise Backup only: Base for incremental backup, either last_backup or last_full_backup" enum: ["last_backup", "last_full_backup"] default: "last_backup" addTimestampToBackupDirectory: type: boolean default: true deleteBackupData: type: boolean default: false status: type: object properties: status: type: string startTime: type: string completionTime: type: string elapsedTime: type: string output: type: string method: type: string source: type: string bucket: type: string ociTenancy: type: string container: type: string spaceAvailable: type: string size: type: string message: type: string subresources: status: {} additionalPrinterColumns: - name: Cluster type: string description: Name of the target cluster jsonPath: .spec.clusterName - name: Status type: string description: Status of the Backup jsonPath: .status.status - name: Output type: string description: Name of the produced file/directory jsonPath: .status.output - name: Age type: date jsonPath: .metadata.creationTimestamp --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: mysqlclustersetfailovers.mysql.oracle.com spec: group: mysql.oracle.com scope: Namespaced names: kind: MySQLClusterSetFailover listKind: MySQLClusterSetFailoverList singular: mysqlclustersetfailover plural: mysqlclustersetfailovers shortNames: - mfo versions: - name: v2 served: true storage: true schema: openAPIV3Schema: type: object properties: spec: type: object required: ["clusterName"] properties: clusterName: type: string force: type: boolean default: false options: type: object properties: invalidateReplicaClusters: type: array items: type: string timeout: type: integer status: type: object properties: status: type: string startTime: type: string completionTime: type: string elapsedTime: type: string subresources: status: {} additionalPrinterColumns: - name: Cluster type: string description: Name of the target cluster jsonPath: .spec.clusterName - name: Status type: string description: Status of the Failover jsonPath: .status.status - name: Age type: date jsonPath: .metadata.creationTimestamp --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: clusterkopfpeerings.zalando.org spec: scope: Cluster group: zalando.org names: kind: ClusterKopfPeering plural: clusterkopfpeerings singular: clusterkopfpeering versions: - name: v1 served: true storage: true schema: openAPIV3Schema: type: object properties: status: type: object x-kubernetes-preserve-unknown-fields: true --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: kopfpeerings.zalando.org spec: scope: Namespaced group: zalando.org names: kind: KopfPeering plural: kopfpeerings singular: kopfpeering versions: - name: v1 served: true storage: true schema: openAPIV3Schema: type: object properties: status: type: object x-kubernetes-preserve-unknown-fields: true --- # Source: mysql-operator/templates/service_account_operator.yaml apiVersion: v1 kind: ServiceAccount metadata: name: mysql-operator-sa namespace: mysql-operator labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: mysql-operator app.kubernetes.io/name: mysql-operator name: mysql-operator version: "26.7.0-2.3.0" app.kubernetes.io/version: "26.7.0-2.3.0" --- # Source: mysql-operator/templates/cluster_role_operator.yaml # Even when `deployment.namespaces` is non-empty, this chart still creates # cluster-scoped `ClusterRoles` for the operator, sidecar, and switchover. # # The access model differs by component: # - Operator: the `ClusterRoleBinding` is created externally by Helm. # - Sidecar and switchover: use namespace-scoped `RoleBindings`. # # The sidecar and switchover bindings are created by the operator and adopted # by it via `kopf`, so they are automatically deleted when the owning cluster # is removed. # # This is an intentional trade-off for two reasons: # 1. Resource scope: # The operator needs access to cluster-scoped resources such as `CRDs` and # `Namespaces`, which cannot be granted through a regular `RoleBinding`. # 2. Operational complexity: # If the operator watches multiple namespaces, Helm would need to create and # maintain separate `Roles` for sidecar and switchover, plus `RoleBindings` # for the operator, in every watched namespace. It would also need to remove # them when the watched namespace list changes. The operator can't create these # themselves as it needs the role bound before it starts. # All this said : deployment.namespaces is a watch filter, not a strong RBAC boundary. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: mysql-operator labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch", "patch"] - apiGroups: [""] resources: ["pods/status"] verbs: ["get", "patch", "update", "watch"] # Kopf needs patch on secrets or the sidecar will throw # The operator needs this verb to be able to pass it to the sidecar - apiGroups: [""] resources: ["secrets"] verbs: ["get", "create", "list", "watch", "patch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "create", "update", "list", "watch", "patch", "delete"] - apiGroups: [""] resources: ["services"] verbs: ["get", "create", "list", "update", "delete", "patch"] - apiGroups: [""] resources: ["serviceaccounts"] verbs: ["get", "create", "patch"] - apiGroups: [""] resources: ["events"] verbs: ["create", "patch", "update"] - apiGroups: ["rbac.authorization.k8s.io"] resources: ["rolebindings"] verbs: ["get", "create", "patch", "delete"] - apiGroups: ["policy"] resources: ["poddisruptionbudgets"] verbs: ["get", "create"] - apiGroups: ["batch"] resources: ["jobs"] verbs: ["create"] - apiGroups: ["batch"] resources: ["cronjobs"] verbs: ["get", "create", "update", "delete"] - apiGroups: ["apps"] resources: ["deployments", "statefulsets"] verbs: ["get", "list", "create", "patch", "update", "watch", "delete"] - apiGroups: ["mysql.oracle.com"] resources: ["*"] verbs: ["*"] - apiGroups: ["zalando.org"] resources: ["*"] verbs: ["get", "patch", "list", "watch"] # Kopf: runtime observation of namespaces & CRDs (addition/deletion). - apiGroups: [apiextensions.k8s.io] resources: [customresourcedefinitions] verbs: [list, watch] - apiGroups: [""] resources: [namespaces] verbs: [list, watch] - apiGroups: ["monitoring.coreos.com"] resources: ["servicemonitors"] verbs: ["get", "create", "patch", "update", "delete"] --- # Source: mysql-operator/templates/cluster_role_sidecar.yaml # role for the server sidecar # This MUST be a cluster scoped role apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: mysql-sidecar labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch", "patch"] - apiGroups: [""] resources: ["pods/status"] verbs: ["get", "patch", "update", "watch"] # Kopf needs patch on secrets or the sidecar will throw - apiGroups: [""] resources: ["secrets"] verbs: ["get", "create", "list", "watch", "patch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "create", "list", "watch", "patch"] - apiGroups: [""] resources: ["services"] verbs: ["get", "create", "list", "update"] - apiGroups: [""] resources: ["serviceaccounts"] verbs: ["get", "create"] - apiGroups: [""] resources: ["events"] verbs: ["create", "patch", "update"] - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "patch"] - apiGroups: ["mysql.oracle.com"] resources: ["innodbclusters"] verbs: ["get", "watch", "list", "patch"] - apiGroups: ["mysql.oracle.com"] resources: ["mysqlbackups"] verbs: ["create", "get", "list", "patch", "update", "watch", "delete"] - apiGroups: ["mysql.oracle.com"] resources: ["mysqlbackups/status"] verbs: ["get", "patch", "update", "watch"] --- # Source: mysql-operator/templates/cluster_role_sidecar.yaml # Role for the switchover CronJob # This MUST be a cluster scoped role apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: mysql-switchover labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "patch", "update"] - apiGroups: [""] resources: ["pods"] verbs: ["get", "list"] - apiGroups: [""] resources: ["secrets"] verbs: ["get"] - apiGroups: ["mysql.oracle.com"] resources: ["innodbclusters"] verbs: ["get"] - apiGroups: ["mysql.oracle.com"] resources: ["innodbclusters/status"] verbs: ["get", "patch"] --- # Source: mysql-operator/templates/cluster_role_binding_operator.yaml # Give access to the operator apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: mysql-operator-rolebinding labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator subjects: - kind: ServiceAccount name: mysql-operator-sa namespace: mysql-operator # TODO The following entry is for dev purposes only #- kind: Group # name: system:serviceaccounts # apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: mysql-operator apiGroup: rbac.authorization.k8s.io --- # Source: mysql-operator/templates/service.yaml apiVersion: v1 kind: Service metadata: name: mysql-operator namespace: mysql-operator labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: mysql-operator app.kubernetes.io/name: mysql-operator name: mysql-operator version: "26.7.0-2.3.0" app.kubernetes.io/version: "26.7.0-2.3.0" spec: type: ClusterIP ports: - port: 9443 protocol: TCP selector: app.kubernetes.io/name: mysql-operator app.kubernetes.io/instance: mysql-operator app.kubernetes.io/component: controller --- # Source: mysql-operator/templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: mysql-operator namespace: mysql-operator annotations: mysql.oracle.com/operator-topology: '{"version":1,"scope":"global","standalone":false,"namespaces":[]}' labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: mysql-operator app.kubernetes.io/name: mysql-operator name: mysql-operator template: metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: mysql-operator app.kubernetes.io/name: mysql-operator app.kubernetes.io/version: 26.7.0-2.3.0 name: mysql-operator version: 26.7.0-2.3.0 spec: securityContext: runAsNonRoot: true containers: - name: mysql-operator image: container-registry.oracle.com/mysql/community-operator:26.7.0-2.3.0 imagePullPolicy: "IfNotPresent" args: ["mysqlsh", "--log-level=@INFO", "--pym", "mysqloperator", "operator"] env: - name: MYSQLSH_USER_CONFIG_HOME value: /mysqlsh - name: MYSQLSH_CREDENTIAL_STORE_SAVE_PASSWORDS value: never - name: MYSQL_OPERATOR_IMAGE_PULL_POLICY value: "IfNotPresent" - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: OPERATOR_DEPLOYMENT_NAME value: mysql-operator - name: OPERATOR_PEERING_NAME value: mysql-operator - name: OPERATOR_ROLE_NAME value: mysql-operator - name: SIDECAR_ROLE_NAME value: mysql-sidecar - name: SWITCHOVER_ROLE_NAME value: mysql-switchover # Comma-separated explicit watched namespaces. Empty means cluster-wide. # Standalone and non-standalone use the same explicit namespace grammar. - name: OPERATOR_NAMESPACES value: "" - name: OPERATOR_STANDALONE value: "false" - name: MYSQL_OPERATOR_DEBUG value: "0" readinessProbe: exec: command: - cat - /tmp/mysql-operator-ready initialDelaySeconds: 1 periodSeconds: 3 volumeMounts: - name: mysqlsh-home mountPath: /mysqlsh - name: tmpdir mountPath: /tmp securityContext: capabilities: drop: - ALL runAsUser: 2 allowPrivilegeEscalation: false privileged: false readOnlyRootFilesystem: true runAsNonRoot: true volumes: - name: mysqlsh-home emptyDir: {} - name: tmpdir emptyDir: {} serviceAccountName: mysql-operator-sa --- # Source: mysql-operator/templates/cluster_kopf_keepering.yaml apiVersion: zalando.org/v1 kind: ClusterKopfPeering metadata: name: mysql-operator labels: app.kubernetes.io/component: controller app.kubernetes.io/created-by: helm app.kubernetes.io/instance: mysql-operator app.kubernetes.io/managed-by: helm app.kubernetes.io/name: mysql-operator