6.10.2 Configuring the MySQL Router User

When MySQL Router connects to a Cluster, ClusterSet, or ReplicaSet, it requires a user account that has the correct privileges. This internal user can be specified using the --account option. In previous versions, MySQL Router created internal accounts at each bootstrap of the cluster, which could result in many accounts building up over time. You can use AdminAPI to set up the user account required for MySQL Router.

Use the setupRouterAccount(user, [options]) operation to create a MySQL user account or upgrade an existing account so that it can be used by MySQL Router to operate on an InnoDB Cluster or InnoDB ReplicaSet. This is the recommended method of configuring MySQL Router with InnoDB Cluster and InnoDB ReplicaSet.

To add a new MySQL Router account named myRouter1 to the InnoDB Cluster referenced by the variable testCluster, issue:

mysqlsh> testCluster.setupRouterAccount('myRouter1')

In this case, no domain is specified and so the account is created with the wildcard (%) character, which ensures that the created user can connect from any domain. To limit the account to only be able to connect from the example.com domain in JavaScript, issue:

mysql-js> testCluster.setupRouterAccount('[e-mail]')

Or using Python:

mysql-py> testCluster.setup_router_account('[e-mail]')

The operation prompts for a password, and then sets up the MySQL Router user with the correct privileges. If the InnoDB Cluster or InnoDB ReplicaSet has multiple instances, the created MySQL Router user is propagated to all of the instances.

You can create the password in the same command which creates the user, with the dictionary option {password: "password"}

When you already have a MySQL Router user configured, you can use the setupRouterAccount() operation to reconfigure the existing user. In this case, pass in the update option set to true. For example, to reconfigure the myOldRouter user, issue the following in JavaScript:

mysql-js> testCluster.setupRouterAccount('myOldRouter', {'update':1})

Or using Python:

mysql-py> testCluster.setup_router_account('myOldRouter', {'update':1})

You can also update the MySQL Router user's password with the dictionary options {password: "newPassword", update: 1} . The following JavaScript example updates the password of the MySQL Router user, myRouter1 to newPassword1#:

mysql-js> testCluster.setupRouterAccount('myRouter1', {password: "newPassword1#",'update':1})

Or using Python:

mysql-py> testCluster.setup_router_account('myRouter1', {password: "newPassword1#", 'update':1})

SSL certificates are also supported. The following options can be used with setupRouterAccount():

• requireCertIssuer: Optional SSL certificate issuer for the account.

• requireCertSubject: Optional SSL certificate subject for the account.

• passwordExpiration: numberOfDays | Never | Default: Password expiration setting for the account.

  • numberOfDays: The number of days before the password expires.

  • Never: The password never expires.

  • Default: The system default is used.