Skip to content

Commit 148b0e5

Browse files
grooverdangrooverdan
committed
Allow healthcheck@{127.0.0.1,::1,localhost} to exist to facilitate healthcheck --connect
healthcheck@{127.0.0.1,::1,localhost} users are granted USAGE by default, which is enough for the non-replication healthchecks in healtcheck.sh. The env variable MARIADB_HEALTHCHECK_GRANTS can replace USAGE with any comma separated set of grants. On initialization a generated password is created and saved in $DATADIR/.my-healthcheck.cnf along with the server port and socket. If the command args or default configuration file changes this may become out of date. Because the password is generated in configuration file the '#', comment, and '=' characters cannot be part of this password. The healthcheck.cnf configuration file also sets protocol=tcp to enforce indirectly that --connect being a standard part of the test. This is required as starts of the service under --skip-networking should never be considered healthy. The healthcheck script also has the --defaults-extra-file set to this .my-healthcheck.cnf file, if it exists (backwards compatible on previously created datadirs), so that all new healthcheck invokations use the authentication here by default. The compatibility with old instances, without the .my-healthcheck.cnf is preserved by non setting --defaults-extra-file. The healthcheck --connect will increment the server status variable Aborted_connects for each check, however now connection_error* counts are changed. This also prevents any invalid password errors showing up in the container log. Closes #430
1 parent 1b4b258 commit 148b0e5

21 files changed

+332
-17
lines changed

‎.test/run.sh‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -174,9 +174,8 @@ checkReplication() {
174174
-e MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=1 \
175175
-e MARIADB_REPLICATION_USER="$mariadb_replication_user" \
176176
-e MARIADB_REPLICATION_PASSWORD="$pass" \
177-
-e MARIADB_MYSQL_LOCALHOST_USER=1 \
178-
-e MARIADB_MYSQL_LOCALHOST_GRANTS="${RPL_MONITOR}" \
179-
--health-cmd='healthcheck.sh --su-mysql --replication_io --replication_sql --replication_seconds_behind_master=0 --replication' \
177+
-e MARIADB_HEALTHCHECK_GRANTS="${RPL_MONITOR}" \
178+
--health-cmd='healthcheck.sh --connect --innodb-initialized --replication_io --replication_sql --replication_seconds_behind_master=0 --replication' \
180179
--health-interval=3s \
181180
"$image" --server-id=3001 --port "${port}"
182181
unset port
@@ -190,7 +189,7 @@ checkReplication() {
190189

191190
docker exec --user mysql -i \
192191
"$cname" \
193-
$mariadb \
192+
$mariadb --defaults-file=/var/lib/mysql/.my-healthcheck.cnf \
194193
-e 'SHOW SLAVE STATUS\G' || die 'error examining replica status'
195194

196195
mariadbclient_unix -u root replcheck --batch --skip-column-names -e 'show create table t1;' || die 'sample table not replicated'
@@ -226,7 +225,7 @@ mariadbclient -u root -e 'show databases'
226225
othertables=$(mariadbclient -u root --skip-column-names -Be "select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA where SCHEMA_NAME not in ('mysql', 'information_schema', 'performance_schema', 'sys')")
227226
[ "${othertables}" != 'NULL' ] && die "unexpected table(s) $othertables"
228227

229-
otherusers=$(mariadbclient -u root --skip-column-names -Be "select user,host from mysql.user where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'))")
228+
otherusers=$(mariadbclient -u root --skip-column-names -Be "select user,host from mysql.global_priv where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'), ('healthcheck', '::1'), ('healthcheck', '127.0.0.1'), ('healthcheck', 'localhost'))")
230229
[ "$otherusers" != '' ] && die "unexpected users $otherusers"
231230

232231
echo "Contents of /var/lib/mysql/{mysql,mariadb}_upgrade_info:"
@@ -246,7 +245,7 @@ killoff
246245
mariadbclient -u root -pexamplepass -e 'select current_user()'
247246
mariadbclient -u root -pwrongpass -e 'select current_user()' || echo 'expected failure'
248247

249-
otherusers=$(mariadbclient -u root -pexamplepass --skip-column-names -Be "select user,host from mysql.user where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'), ('mysql','localhost'))")
248+
otherusers=$(mariadbclient -u root -pexamplepass --skip-column-names -Be "select user,host from mysql.global_priv where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'), ('mysql','localhost'), ('healthcheck', '::1'), ('healthcheck', '127.0.0.1'), ('healthcheck', 'localhost'))")
250249
[ "$otherusers" != '' ] && die "unexpected users $otherusers"
251250

252251
createuser=$(docker exec --user mysql -i \
@@ -266,6 +265,22 @@ killoff
266265
# shellcheck disable=SC2016
267266
[ "${grants//\'/\`}" == 'GRANT USAGE ON *.* TO `mysql`@`localhost` IDENTIFIED VIA unix_socket' ] || die "I wasn't granted what I was expected"
268267

268+
createuser=$(docker exec --user mysql -i \
269+
"$cname" \
270+
$mariadb --defaults-file=/var/lib/mysql/.my-healthcheck.cnf \
271+
--silent \
272+
-e "show create user")
273+
# shellcheck disable=SC2016
274+
[[ "${createuser//\'/\`}" =~ 'CREATE USER `healthcheck`@`localhost` IDENTIFIED' ]] || die "I wasn't created how I was expected"
275+
276+
grants="$(docker exec --user mysql -i \
277+
$cname \
278+
$mariadb --defaults-file=/var/lib/mysql/.my-healthcheck.cnf \
279+
--silent \
280+
-e show\ grants)"
281+
282+
# shellcheck disable=SC2016
283+
[[ "${grants//\'/\`}" =~ 'GRANT USAGE ON *.* TO `healthcheck`@`localhost`' ]] || die "I wasn't granted what I was expected"
269284
killoff
270285

271286
;&
@@ -458,7 +473,7 @@ mariadbclient -u root -e 'show databases'
458473
othertables=$(mariadbclient -u root --skip-column-names -Be "select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA where SCHEMA_NAME not in ('mysql', 'information_schema', 'performance_schema', 'sys')")
459474
[ "${othertables}" != 'NULL' ] && die "unexpected table(s) $othertables"
460475

461-
otherusers=$(mariadbclient -u root --skip-column-names -Be "select user,host from mysql.user where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'), ('mysql','localhost'))")
476+
otherusers=$(mariadbclient -u root --skip-column-names -Be "select user,host from mysql.user where (user,host) not in (('root', 'localhost'), ('root', '%'), ('mariadb.sys', 'localhost'), ('mysql','localhost'), ('healthcheck', '::1'), ('healthcheck', '127.0.0.1'), ('healthcheck', 'localhost'))")
462477
[ "$otherusers" != '' ] && die "unexpected users $otherusers"
463478
killoff
464479

‎10.10/docker-entrypoint.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,9 +226,10 @@ docker_init_database_dir() {
226226
# This should be called after mysql_check_config, but before any other functions
227227
docker_setup_env() {
228228
# Get config
229-
declare -g DATADIR SOCKET
229+
declare -g DATADIR SOCKET PORT
230230
DATADIR="$(mysql_get_config 'datadir' "$@")"
231231
SOCKET="$(mysql_get_config 'socket' "$@")"
232+
PORT="$(mysql_get_config 'port' "$@")"
232233

233234

234235
# Initialize values that might be stored in a file
@@ -364,6 +365,29 @@ docker_setup_db() {
364365
fi
365366
fi
366367

368+
local healthCheckUser
369+
local healthCheckGrant=USAGE
370+
local healthCheckConnectPass
371+
local healthCheckConnectPassEscaped
372+
healthCheckConnectPass="$(pwgen --numerals --capitalize --symbols --remove-chars="=#'\\" -1 32)"
373+
healthCheckConnectPassEscaped=$( docker_sql_escape_string_literal "${healthCheckConnectPass}" )
374+
if [ -n "$MARIADB_HEALTHCHECK_GRANTS" ]; then
375+
healthCheckGrant="$MARIADB_HEALTHCHECK_GRANTS"
376+
fi
377+
read -r -d '' healthCheckUser <<-EOSQL || true
378+
CREATE USER healthcheck@'127.0.0.1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
379+
CREATE USER healthcheck@'::1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
380+
CREATE USER healthcheck@localhost IDENTIFIED BY '$healthCheckConnectPassEscaped';
381+
GRANT $healthCheckGrant ON *.* TO healthcheck@'127.0.0.1';
382+
GRANT $healthCheckGrant ON *.* TO healthcheck@'::1';
383+
GRANT $healthCheckGrant ON *.* TO healthcheck@localhost;
384+
EOSQL
385+
local maskPreserve
386+
maskPreserve=$(umask -p)
387+
umask 0077
388+
echo -e "[mariadb-client]\\nport=$PORT\\nsocket=$SOCKET\\nuser=healthcheck\\npassword=$healthCheckConnectPass\\nprotocol=tcp\\n" > "$DATADIR"/.my-healthcheck.cnf
389+
$maskPreserve
390+
367391
local rootLocalhostPass=
368392
if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
369393
# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
@@ -433,6 +457,7 @@ docker_setup_db() {
433457
${rootCreate}
434458
${mysqlAtLocalhost}
435459
${mysqlAtLocalhostGrants}
460+
${healthCheckUser}
436461
-- end of securing system users, rest of init now...
437462
SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
438463
-- create users/databases

‎10.10/healthcheck.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ _process_sql()
5555
connect()
5656
{
5757
set +e +o pipefail
58+
# (on second extra_file)
59+
# shellcheck disable=SC2086
5860
mariadb ${nodefaults:+--no-defaults} \
5961
${def['file']:+--defaults-file=${def['file']}} \
6062
${def['extra_file']:+--defaults-extra-file=${def['extra_file']}} \
@@ -210,6 +212,9 @@ declare -A repl
210212
declare -A def
211213
nodefaults=
212214
datadir=/var/lib/mysql
215+
if [ -f $datadir/.my-healthcheck.cnf ]; then
216+
def['extra_file']=$datadir/.my-healthcheck.cnf
217+
fi
213218

214219
_repl_param_check()
215220
{

‎10.11/docker-entrypoint.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,9 +226,10 @@ docker_init_database_dir() {
226226
# This should be called after mysql_check_config, but before any other functions
227227
docker_setup_env() {
228228
# Get config
229-
declare -g DATADIR SOCKET
229+
declare -g DATADIR SOCKET PORT
230230
DATADIR="$(mysql_get_config 'datadir' "$@")"
231231
SOCKET="$(mysql_get_config 'socket' "$@")"
232+
PORT="$(mysql_get_config 'port' "$@")"
232233

233234

234235
# Initialize values that might be stored in a file
@@ -364,6 +365,29 @@ docker_setup_db() {
364365
fi
365366
fi
366367

368+
local healthCheckUser
369+
local healthCheckGrant=USAGE
370+
local healthCheckConnectPass
371+
local healthCheckConnectPassEscaped
372+
healthCheckConnectPass="$(pwgen --numerals --capitalize --symbols --remove-chars="=#'\\" -1 32)"
373+
healthCheckConnectPassEscaped=$( docker_sql_escape_string_literal "${healthCheckConnectPass}" )
374+
if [ -n "$MARIADB_HEALTHCHECK_GRANTS" ]; then
375+
healthCheckGrant="$MARIADB_HEALTHCHECK_GRANTS"
376+
fi
377+
read -r -d '' healthCheckUser <<-EOSQL || true
378+
CREATE USER healthcheck@'127.0.0.1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
379+
CREATE USER healthcheck@'::1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
380+
CREATE USER healthcheck@localhost IDENTIFIED BY '$healthCheckConnectPassEscaped';
381+
GRANT $healthCheckGrant ON *.* TO healthcheck@'127.0.0.1';
382+
GRANT $healthCheckGrant ON *.* TO healthcheck@'::1';
383+
GRANT $healthCheckGrant ON *.* TO healthcheck@localhost;
384+
EOSQL
385+
local maskPreserve
386+
maskPreserve=$(umask -p)
387+
umask 0077
388+
echo -e "[mariadb-client]\\nport=$PORT\\nsocket=$SOCKET\\nuser=healthcheck\\npassword=$healthCheckConnectPass\\nprotocol=tcp\\n" > "$DATADIR"/.my-healthcheck.cnf
389+
$maskPreserve
390+
367391
local rootLocalhostPass=
368392
if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
369393
# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
@@ -433,6 +457,7 @@ docker_setup_db() {
433457
${rootCreate}
434458
${mysqlAtLocalhost}
435459
${mysqlAtLocalhostGrants}
460+
${healthCheckUser}
436461
-- end of securing system users, rest of init now...
437462
SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
438463
-- create users/databases

‎10.11/healthcheck.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ _process_sql()
5555
connect()
5656
{
5757
set +e +o pipefail
58+
# (on second extra_file)
59+
# shellcheck disable=SC2086
5860
mariadb ${nodefaults:+--no-defaults} \
5961
${def['file']:+--defaults-file=${def['file']}} \
6062
${def['extra_file']:+--defaults-extra-file=${def['extra_file']}} \
@@ -210,6 +212,9 @@ declare -A repl
210212
declare -A def
211213
nodefaults=
212214
datadir=/var/lib/mysql
215+
if [ -f $datadir/.my-healthcheck.cnf ]; then
216+
def['extra_file']=$datadir/.my-healthcheck.cnf
217+
fi
213218

214219
_repl_param_check()
215220
{

‎10.4/docker-entrypoint.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,9 +225,10 @@ docker_init_database_dir() {
225225
# This should be called after mysql_check_config, but before any other functions
226226
docker_setup_env() {
227227
# Get config
228-
declare -g DATADIR SOCKET
228+
declare -g DATADIR SOCKET PORT
229229
DATADIR="$(mysql_get_config 'datadir' "$@")"
230230
SOCKET="$(mysql_get_config 'socket' "$@")"
231+
PORT="$(mysql_get_config 'port' "$@")"
231232

232233

233234
# Initialize values that might be stored in a file
@@ -363,6 +364,29 @@ docker_setup_db() {
363364
fi
364365
fi
365366

367+
local healthCheckUser
368+
local healthCheckGrant=USAGE
369+
local healthCheckConnectPass
370+
local healthCheckConnectPassEscaped
371+
healthCheckConnectPass="$(pwgen --numerals --capitalize --symbols --remove-chars="=#'\\" -1 32)"
372+
healthCheckConnectPassEscaped=$( docker_sql_escape_string_literal "${healthCheckConnectPass}" )
373+
if [ -n "$MARIADB_HEALTHCHECK_GRANTS" ]; then
374+
healthCheckGrant="$MARIADB_HEALTHCHECK_GRANTS"
375+
fi
376+
read -r -d '' healthCheckUser <<-EOSQL || true
377+
CREATE USER healthcheck@'127.0.0.1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
378+
CREATE USER healthcheck@'::1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
379+
CREATE USER healthcheck@localhost IDENTIFIED BY '$healthCheckConnectPassEscaped';
380+
GRANT $healthCheckGrant ON *.* TO healthcheck@'127.0.0.1';
381+
GRANT $healthCheckGrant ON *.* TO healthcheck@'::1';
382+
GRANT $healthCheckGrant ON *.* TO healthcheck@localhost;
383+
EOSQL
384+
local maskPreserve
385+
maskPreserve=$(umask -p)
386+
umask 0077
387+
echo -e "[mariadb-client]\\nport=$PORT\\nsocket=$SOCKET\\nuser=healthcheck\\npassword=$healthCheckConnectPass\\nprotocol=tcp\\n" > "$DATADIR"/.my-healthcheck.cnf
388+
$maskPreserve
389+
366390
local rootLocalhostPass=
367391
if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
368392
# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
@@ -432,6 +456,7 @@ docker_setup_db() {
432456
${rootCreate}
433457
${mysqlAtLocalhost}
434458
${mysqlAtLocalhostGrants}
459+
${healthCheckUser}
435460
-- end of securing system users, rest of init now...
436461
SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
437462
-- create users/databases

‎10.4/healthcheck.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ _process_sql()
5555
connect()
5656
{
5757
set +e +o pipefail
58+
# (on second extra_file)
59+
# shellcheck disable=SC2086
5860
mysql ${nodefaults:+--no-defaults} \
5961
${def['file']:+--defaults-file=${def['file']}} \
6062
${def['extra_file']:+--defaults-extra-file=${def['extra_file']}} \
@@ -210,6 +212,9 @@ declare -A repl
210212
declare -A def
211213
nodefaults=
212214
datadir=/var/lib/mysql
215+
if [ -f $datadir/.my-healthcheck.cnf ]; then
216+
def['extra_file']=$datadir/.my-healthcheck.cnf
217+
fi
213218

214219
_repl_param_check()
215220
{

‎10.5/docker-entrypoint.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,9 +225,10 @@ docker_init_database_dir() {
225225
# This should be called after mysql_check_config, but before any other functions
226226
docker_setup_env() {
227227
# Get config
228-
declare -g DATADIR SOCKET
228+
declare -g DATADIR SOCKET PORT
229229
DATADIR="$(mysql_get_config 'datadir' "$@")"
230230
SOCKET="$(mysql_get_config 'socket' "$@")"
231+
PORT="$(mysql_get_config 'port' "$@")"
231232

232233

233234
# Initialize values that might be stored in a file
@@ -363,6 +364,29 @@ docker_setup_db() {
363364
fi
364365
fi
365366

367+
local healthCheckUser
368+
local healthCheckGrant=USAGE
369+
local healthCheckConnectPass
370+
local healthCheckConnectPassEscaped
371+
healthCheckConnectPass="$(pwgen --numerals --capitalize --symbols --remove-chars="=#'\\" -1 32)"
372+
healthCheckConnectPassEscaped=$( docker_sql_escape_string_literal "${healthCheckConnectPass}" )
373+
if [ -n "$MARIADB_HEALTHCHECK_GRANTS" ]; then
374+
healthCheckGrant="$MARIADB_HEALTHCHECK_GRANTS"
375+
fi
376+
read -r -d '' healthCheckUser <<-EOSQL || true
377+
CREATE USER healthcheck@'127.0.0.1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
378+
CREATE USER healthcheck@'::1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
379+
CREATE USER healthcheck@localhost IDENTIFIED BY '$healthCheckConnectPassEscaped';
380+
GRANT $healthCheckGrant ON *.* TO healthcheck@'127.0.0.1';
381+
GRANT $healthCheckGrant ON *.* TO healthcheck@'::1';
382+
GRANT $healthCheckGrant ON *.* TO healthcheck@localhost;
383+
EOSQL
384+
local maskPreserve
385+
maskPreserve=$(umask -p)
386+
umask 0077
387+
echo -e "[mariadb-client]\\nport=$PORT\\nsocket=$SOCKET\\nuser=healthcheck\\npassword=$healthCheckConnectPass\\nprotocol=tcp\\n" > "$DATADIR"/.my-healthcheck.cnf
388+
$maskPreserve
389+
366390
local rootLocalhostPass=
367391
if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
368392
# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
@@ -432,6 +456,7 @@ docker_setup_db() {
432456
${rootCreate}
433457
${mysqlAtLocalhost}
434458
${mysqlAtLocalhostGrants}
459+
${healthCheckUser}
435460
-- end of securing system users, rest of init now...
436461
SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
437462
-- create users/databases

‎10.5/healthcheck.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ _process_sql()
5555
connect()
5656
{
5757
set +e +o pipefail
58+
# (on second extra_file)
59+
# shellcheck disable=SC2086
5860
mysql ${nodefaults:+--no-defaults} \
5961
${def['file']:+--defaults-file=${def['file']}} \
6062
${def['extra_file']:+--defaults-extra-file=${def['extra_file']}} \
@@ -210,6 +212,9 @@ declare -A repl
210212
declare -A def
211213
nodefaults=
212214
datadir=/var/lib/mysql
215+
if [ -f $datadir/.my-healthcheck.cnf ]; then
216+
def['extra_file']=$datadir/.my-healthcheck.cnf
217+
fi
213218

214219
_repl_param_check()
215220
{

‎10.6/docker-entrypoint.sh‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,9 +226,10 @@ docker_init_database_dir() {
226226
# This should be called after mysql_check_config, but before any other functions
227227
docker_setup_env() {
228228
# Get config
229-
declare -g DATADIR SOCKET
229+
declare -g DATADIR SOCKET PORT
230230
DATADIR="$(mysql_get_config 'datadir' "$@")"
231231
SOCKET="$(mysql_get_config 'socket' "$@")"
232+
PORT="$(mysql_get_config 'port' "$@")"
232233

233234

234235
# Initialize values that might be stored in a file
@@ -364,6 +365,29 @@ docker_setup_db() {
364365
fi
365366
fi
366367

368+
local healthCheckUser
369+
local healthCheckGrant=USAGE
370+
local healthCheckConnectPass
371+
local healthCheckConnectPassEscaped
372+
healthCheckConnectPass="$(pwgen --numerals --capitalize --symbols --remove-chars="=#'\\" -1 32)"
373+
healthCheckConnectPassEscaped=$( docker_sql_escape_string_literal "${healthCheckConnectPass}" )
374+
if [ -n "$MARIADB_HEALTHCHECK_GRANTS" ]; then
375+
healthCheckGrant="$MARIADB_HEALTHCHECK_GRANTS"
376+
fi
377+
read -r -d '' healthCheckUser <<-EOSQL || true
378+
CREATE USER healthcheck@'127.0.0.1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
379+
CREATE USER healthcheck@'::1' IDENTIFIED BY '$healthCheckConnectPassEscaped';
380+
CREATE USER healthcheck@localhost IDENTIFIED BY '$healthCheckConnectPassEscaped';
381+
GRANT $healthCheckGrant ON *.* TO healthcheck@'127.0.0.1';
382+
GRANT $healthCheckGrant ON *.* TO healthcheck@'::1';
383+
GRANT $healthCheckGrant ON *.* TO healthcheck@localhost;
384+
EOSQL
385+
local maskPreserve
386+
maskPreserve=$(umask -p)
387+
umask 0077
388+
echo -e "[mariadb-client]\\nport=$PORT\\nsocket=$SOCKET\\nuser=healthcheck\\npassword=$healthCheckConnectPass\\nprotocol=tcp\\n" > "$DATADIR"/.my-healthcheck.cnf
389+
$maskPreserve
390+
367391
local rootLocalhostPass=
368392
if [ -z "$MARIADB_ROOT_PASSWORD_HASH" ]; then
369393
# handle MARIADB_ROOT_PASSWORD_HASH for root@localhost after /docker-entrypoint-initdb.d
@@ -433,6 +457,7 @@ docker_setup_db() {
433457
${rootCreate}
434458
${mysqlAtLocalhost}
435459
${mysqlAtLocalhostGrants}
460+
${healthCheckUser}
436461
-- end of securing system users, rest of init now...
437462
SET @@SESSION.SQL_LOG_BIN=@orig_sql_log_bin;
438463
-- create users/databases

0 commit comments

Comments
 (0)