库伯奈特斯的春天试图在荚IP到达DB。

Question

我在部署Spring时遇到了一个问题，它应该连接到MySQL数据库。

我使用具有以下值的bitnami头盔图表部署独立的MySQL：

        primary:
          service:
            type: ClusterIP
          persistence:
            enabled: true
            size: 3Gi
            storageClass: ""
          extraVolumes:
          - name: mysql-passwords 
            csi:
              driver: secrets-store.csi.k8s.io
              readOnly: true
              volumeAttributes:
                secretProviderClass: mysql-spc
          extraVolumeMounts:
          - name: mysql-passwords
            mountPath: "/vault/secrets"
            readOnly: true
          configuration: |-
            [mysqld]
            default_authentication_plugin=mysql_native_password
            skip-name-resolve
            explicit_defaults_for_timestamp
            basedir=/opt/bitnami/mysql
            plugin_dir=/opt/bitnami/mysql/lib/plugin
            port=3306
            socket=/opt/bitnami/mysql/tmp/mysql.sock
            datadir=/bitnami/mysql/data
            tmpdir=/opt/bitnami/mysql/tmp
            max_allowed_packet=16M
            bind-address=0.0.0.0
            pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
            log-error=/opt/bitnami/mysql/logs/mysqld.log
            character-set-server=UTF8
            collation-server=utf8_general_ci
            slow_query_log=0
            slow_query_log_file=/opt/bitnami/mysql/logs/mysqld.log
            long_query_time=10.0

            [client]
            port=3306
            socket=/opt/bitnami/mysql/tmp/mysql.sock
            default-character-set=UTF8
            plugin_dir=/opt/bitnami/mysql/lib/plugin

            [manager]
            port=3306
            socket=/opt/bitnami/mysql/tmp/mysql.sock
            pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
        auth:
          createDatabase: true  
          database: api-db
          username: api
          usePasswordFiles: true
          customPasswordFiles:
            root: /vault/secrets/db-root-pwd
            user: /vault/secrets/db-pwd
            replicator: /vault/secrets/db-replica-pwd
        serviceAccount:
          create: false
          name: social-app

我使用以下部署，它运行spring (使用Vault秘密注入)：

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: social-api
  name: social-api
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: social-api
  template:
    metadata:
      labels:
        app: social-api
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: 'social'

    spec:
      serviceAccountName: social-app
      containers:
      - image: quay.io/paulbarrie7/social-network-api
        name: social-network-api
        command:
          - java
        args:
          - -jar
          - "-DSPRING_DATASOURCE_URL=jdbc:mysql://social-mysql.default.svc.cluster.local/api-db?useSSL=false"
          - "-DSPRING_DATASOURCE_USERNAME=api"
          - "-DSPRING_DATASOURCE_PASSWORD=$(cat /secrets/db-pwd)"
          - "-DJWT_SECRET=$(cat /secrets/jwt-secret)"
          - "-DS3_BUCKET=$(cat /secrets/s3-bucket)"
          - -Dlogging.level.root=DEBUG
          - -Dspring.datasource.hikari.maximum-pool-size=5
          - -Dlogging.level.com.zaxxer.hikari.HikariConfig=DEBUG
          - -Dlogging.level.com.zaxxer.hikari=TRACE
          - social-network-api-1.0-SNAPSHOT.jar
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: aws-credentials
          mountPath: "/root/.aws"
          readOnly: true
        - name: java-secrets
          mountPath: "/secrets"
          readOnly: true
      volumes:
      - name: aws-credentials
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: aws-secret-spc
      - name: java-secrets
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: java-spc

标识符是可以的，当我运行交互式mysql时，我可以连接到数据库。但是，Spring的名称解析是错误的，因为我得到了错误：

java.sql.SQLException: Access denied for user 'api'@'10.24.0.194' (using password: YES)

这是错误的，因为10.24.0.194是API地址，而不是mysql或服务地址，我无法解释为什么。

知道吗? 1：https://artifacthub.io/packages/helm/bitnami/mysql

Answer 1

由于大卫的建议，我成功地解决了我的问题。

事实上，我的吐露中有两个问题。

首先，这些秘密确实被误解了，然后我将命令/args更改为：

command:
          - "/bin/sh"
          - "-c"
        args:
          - |
            DB_USER=$(cat /secrets/db-user)
            DB_PWD=$(cat /secrets/db-pwd)
            JWT=$(cat /secrets/jwt-secret)
            BUCKET=$(cat /secrets/s3-bucket)
            java -jar  \
            -DSPRING_DATASOURCE_URL=jdbc:mysql://social-mysql.default.svc.cluster.local/api-db?useSSL=false \
            "-DSPRING_DATASOURCE_USERNAME=$DB_USER" \
            "-DSPRING_DATASOURCE_PASSWORD=$DB_PWD" \
            "-DJWT_SECRET=$JWT" \
            "-DS3_BUCKET=$BUCKET" \
            -Dlogging.level.root=DEBUG \
            social-network-api-1.0-SNAPSHOT.jar

内存资源集也太低，因此我将它们更改为：

resources:
 limits:
  cpu: 100m
  memory: 400Mi
 requests:
  cpu: 100m
  memory: 400Mi