riveraja

How to reproduce sysown/proxysql#1850

Setup a 3-node GR cluster and 1 async node in a single VM or Container.

[root@mgrsvr ~]# ps aux|grep mysql[d]
mysql      514  127  2.7 2443360 451456 ?      Sl   01:46   1:35 mysqld --defaults-file=/config/s1.conf --user=mysql --log_error=/data/s1.log
mysql      515  129  2.7 2575004 451456 ?      Sl   01:46   1:37 mysqld --defaults-file=/config/s2.conf --user=mysql --log_error=/data/s2.log
mysql      516  127  2.7 2443360 451032 ?      Sl   01:46   1:35 mysqld --defaults-file=/config/s3.conf --user=mysql --log_error=/data/s3.log
mysql      819  0.0  2.5 1998760 414172 ?      Sl   02:24   0:43 mysqld --defaults-file=/config/s4.conf --user=mysql --log_error=/data/s4.log

riveraja

Backing up from the master

First you need to download and use the latest Percona XtraBackup package, in this tutorial I used this version:

[root@mysql1 ~]# xtrabackup --version
xtrabackup: recognized server arguments: --datadir=/var/lib/mysql --log_bin=mysqld-bin --server-id=1
xtrabackup version 2.4.12 based on MySQL server 5.7.19 Linux (x86_64) (revision id: 170eb8c)

Create a transition key using any method you prefer, this transition key will be used by xtrabackup to encrypt keys of files being backed up.

riveraja

Configuring Vault

To setup Vault with SSL enabled. Refer to this gist on how to easily create SSL certificates to be used by Vault: https://gist.github.com/riveraja/f9e3ed84b54fddb935baf4742a8febe9#file-create_ssl_using_terraform-md

Once the SSL certificates are created start Vault with this sample configuration

[root@vault1 ~]# cat /etc/vault.hcl
listener "tcp" {
 address = "192.168.0.114:8200"

riveraja

This post will guide you in creating TLS keys for Vault with Terraform using terraform-google-vault private-tls-cert submodule [https://registry.terraform.io/modules/hashicorp/vault/google/0.0.4/submodules/private-tls-cert].

We will need to download Hashicorp Terraform tool from https://www.terraform.io/downloads.html and then unzip the compressed file:

# wget https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip
--2018-06-18 12:19:33--  https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip
Resolving releases.hashicorp.com (releases.hashicorp.com)... 151.101.1.183, 151.101.65.183, 151.101.129.183, ...
Connecting to releases.hashicorp.com (releases.hashicorp.com)|151.101.1.183|:443... connected.
HTTP request sent, awaiting response... 200 OK

riveraja

Keybase proof

I hereby claim:

• I am riveraja on github.
• I am jerichorivera (https://keybase.io/jerichorivera) on keybase.
• I have a public key ASDykqlhWt5uAZWnoRA5JNIWw78WkIlIWdFbvO5tmnn9Ngo

To claim this, I am signing this object: