8.4 中文镜像

MySQL 8.4 参考手册 · 中文镜像

正文为中文，英文原文默认隐藏。点击任意中文段落即可展开 / 收起对应英文原文。

打开官方英文原文 ↗

译文由机器翻译生成，仅供理解参考；有疑问请以官方英文原文为准。

MySQL 8.4 参考手册 / 20 组复制 / 20.6 组复制安全性 / 20.6.1 连接安全管理的通信堆栈
中文点击中文段落可显示 / 隐藏英文原文本页译文覆盖 100%

20.6.1 连接安全管理的通信堆栈20.6.1 Communication Stack for Connection Security Management

MySQL 8.4 组复制可以通过以下方法之一保护成员之间的组通信连接：MySQL 8.4 Group Replication can secure group communication connections between members by one of the following methods:

  • 使用其自身实现的安全协议，包括 TLS/SSL，以及对传入的组通信系统(GCS)连接使用允许列表。Using its own implementation of the security protocols, including TLS/SSL and the use of an allowlist for incoming Group Communication System (GCS) connections.

  • 使用 MySQL 服务器自身的连接安全性来替代 Group Replication 的实现。使用 MySQL 协议意味着可以使用标准的用户认证方法来授予（或撤销）对组的访问权限，从而替代允许列表，并且服务器协议的最新功能在发布时总是可用的。Using MySQL Server’s own connection security in place of Group Replication’s implementation. Using the MySQL protocol means that standard methods of user authentication can be used for granting (or revoking) access to the group in place of the allowlist, and the latest functionality of the server’s protocol is always available on release.

可以通过将系统变量 group_replication_communication_stack 设置为 XCOM 来使用 Group Replication 自身的实现（这是默认选项），或者设置为 MYSQL 来使用 MySQL 服务器的连接安全性。The choice is made by setting the system variable group_replication_communication_stack to XCOM to use Group Replication's own implementation (this is the default choice), or to MYSQL to use MySQL Server's connection security.

使用 MySQL 通信栈的复制组需要以下额外配置。在将组的通信栈从 XCom 切换到 MySQL 时，尤其需要确保所有这些要求都已满足。The following additional configuration is required for a replication group to use the MySQL communication stack. It is especially important to make sure these requirements are all fulfilled when you switch from using the XCom communication stack to the MySQL communication stack for your group.

MySQL 通信栈的组复制要求Group Replication Requirements For The MySQL Communication Stack

  • 为每个组成员配置的 group_replication_local_address 系统变量的网络地址，必须设置为 MySQL 服务器正在监听的一个 IP 地址和端口，如服务器的 bind_address 系统变量所指定。每个成员的 IP 地址和端口组合在组中必须唯一。建议为每个组成员配置 group_replication_group_seeds 系统变量，使其包含所有组成员的所有本地地址。The network address configured by the group_replication_local_address system variable for each group member must be set to one of the IP addresses and ports that MySQL Server is listening on, as specified by the bind_address system variable for the server. The combination of IP address and port for each member must be unique in the group. It is recommended that the group_replication_group_seeds system variable for each group member be configured to contain all the local addresses for all the group members.

  • MySQL 通信堆栈支持网络命名空间，而 XCom 通信堆栈不支持。如果在组成员的 Group Replication 本地地址 (group_replication_local_address) 中使用网络命名空间，则必须使用 CHANGE REPLICATION SOURCE TO 语句为每个组成员进行配置。此外，每个组成员的 report_host 服务器系统变量必须设置为报告命名空间。所有组成员必须使用相同的命名空间，以避免在分布式恢复期间可能出现的地址解析问题。The MySQL communication stack supports network namespaces, which the XCom communication stack does not support. If network namespaces are used with the Group Replication local addresses for the group members (group_replication_local_address), these must be configured for each group member using the CHANGE REPLICATION SOURCE TO statement. Also, the report_host server system variable for each group member must be set to report the namespace. All group members must use the same namespace to avoid possible issues with address resolution during distributed recovery.

  • group_replication_ssl_mode 系统变量必须设置为组通信所需的设置。该系统变量控制组通信中是否启用或禁用 TLS/SSL。当使用 MySQL 通信栈时，TLS/SSL 配置取自组复制的分布式恢复设置。此设置在所有组成员中应保持一致，以避免潜在冲突。The group_replication_ssl_mode system variable must be set to the required setting for group communications. This system variable controls whether TLS/SSL is enabled or disabled for group communications. When the MySQL communication stack is used, the TLS/SSL configuration is taken from Group Replication’s distributed recovery settings. This setting should be the same on all the group members, to avoid potential conflicts.

  • 所有组成员的 require_secure_transport 服务器系统变量值应保持一致，以避免潜在冲突。如果 group_replication_ssl_mode 设置为 REQUIRED、VERIFY_CA 或 VERIFY_IDENTITY，请使用 require_secure_transport=ON。如果 group_replication_ssl_mode 设置为 DISABLED，请使用require_secure_transport=OFF。The require_secure_transport server system variable value should be the same on all the group members, to avoid potential conflicts. If group_replication_ssl_mode is set to REQUIRED, VERIFY_CA, or VERIFY_IDENTITY, use require_secure_transport=ON. If group_replication_ssl_mode is set to DISABLED, use require_secure_transport=OFF.

  • 如果为组通信启用了 TLS/SSL，则必须配置组复制用于保护分布式恢复的设置（如果尚未配置），或者验证这些设置（如果已经配置）。MySQL 通信堆栈使用这些设置不仅用于成员之间的分布式恢复连接，也用于一般组通信中的 TLS/SSL 配置。group_replication_recovery_use_ssl 和其他 group_replication_recovery_* 系统变量在 第 20.6.3.2 节，“分布式恢复的安全套接字层 (SSL) 连接” 中有解释。If TLS/SSL is enabled for group communications, Group Replication’s settings for securing distributed recovery must be configured if they are not already in place, or validated if they already are. The MySQL communication stack uses these settings not just for member-to-member distributed recovery connections, but also for TLS/SSL configuration in general group communications. group_replication_recovery_use_ssl and the other group_replication_recovery_* system variables are explained in Section 20.6.3.2, “Secure Socket Layer (SSL) Connections for Distributed Recovery”.

  • 当组使用 MySQL 通信栈时，不使用组复制允许列表，因此 group_replication_ip_allowlist 系统变量会被忽略，无需设置。The Group Replication allowlist is not used when the group is using the MySQL communication stack, so the group_replication_ip_allowlist system variable is ignored and need not be set.

  • 组复制用于分布式恢复的复制用户帐户，通过使用 CHANGE REPLICATION SOURCE TO 语句进行配置，在建立组复制连接时由 MySQL 通信栈用于身份验证。这个用户帐户在所有组成员中都是相同的，必须赋予以下权限：The replication user account that Group Replication uses for distributed recovery, as configured using the CHANGE REPLICATION SOURCE TO statement, is used for authentication by the MySQL communication stack when setting up Group Replication connections. This user account, which is the same on all group members, must be given the following privileges:

    • GROUP_REPLICATION_STREAM。用户账户需要该权限，才能使用 MySQL 通信堆栈建立组复制连接。GROUP_REPLICATION_STREAM. This privilege is required for the user account to be able to establish connections for Group Replication using the MySQL communication stack.

    • CONNECTION_ADMIN。用户需要该权限，以确保如果参与的某个服务器被置于离线模式时，组复制连接不会被终止。如果在没有该权限的情况下使用 MySQL 通信堆栈，被置于离线模式的成员将被从组中剔除。CONNECTION_ADMIN. This privilege is required so that Group Replication connections are not terminated if one of the servers involved is placed in offline mode. If the MySQL communication stack is in use without this privilege, a member that is placed in offline mode is expelled from the group.

    这些是除了所有复制用户账户必须具有的 REPLICATION SLAVE 和 BACKUP_ADMIN 权限之外的（参见 第 20.2.1.3 节，“分布式恢复的用户凭证”）。当你添加新的权限时，请确保在每个组成员上通过发出 SET SQL_LOG_BIN=0 来跳过二进制日志记录，然后再发出 GRANT 语句，之后再执行 SET SQL_LOG_BIN=1，以确保本地事务不会干扰组复制的重新启动。These are in addition to the privileges REPLICATION SLAVE and BACKUP_ADMIN that all replication user accounts must have (see Section 20.2.1.3, “User Credentials For Distributed Recovery”). When you add the new privileges, ensure that you skip binary logging on each group member by issuing SET SQL_LOG_BIN=0 before you issue the GRANT statements, and SET SQL_LOG_BIN=1 after them, so that the local transaction does not interfere with restarting Group Replication.

group_replication_communication_stack 实际上是一个全组的配置设置，并且该设置必须在所有组成员上相同。然而，这一设置并不会受到 Group Replication 对全组配置设置自身检查的限制。与组中其他成员设置不同的成员根本无法与其他成员通信，因为通信协议不兼容，因此它无法交换有关其配置设置的信息。group_replication_communication_stack is effectively a group-wide configuration setting, and the setting must be the same on all group members. However, this is not policed by Group Replication’s own checks for group-wide configuration settings. A member with a different value from the rest of the group cannot communicate with the other members at all, because the communication protocols are incompatible, so it cannot exchange information about its configuration settings.

这意味着，尽管在群组复制运行时可以更改系统变量的值，并且在重新启动该组成员上的群组复制后生效，但该成员仍然无法重新加入群组，直到所有成员上的设置都已更改。因此，您必须停止所有成员上的群组复制，并在它们上更改系统变量的值，然后才能重新启动群组。由于所有成员都已停止，需要对群组进行完全重启（由设置了 group_replication_bootstrap_group=ON 的服务器引导）以使值更改生效。在成员停止时，您可以对群组成员进行其他所需的设置更改。This means that although the value of the system variable can be changed while Group Replication is running, and takes effect after you restart Group Replication on the group member, the member still cannot rejoin the group until the setting has been changed on all the members. You must therefore stop Group Replication on all of the members and change the value of the system variable on them all before you can restart the group. Because all of the members are stopped, a full reboot of the group (a bootstrap by a server with group_replication_bootstrap_group=ON) is required in order for the value change to take effect. You can make the other required changes to settings on the group members while they are stopped.

对于一个运行组，请按照以下步骤更改 group_replication_communication_stack 的值以及其他所需设置，以将组从 XCom 通信栈迁移到 MySQL 通信栈，或从 MySQL 通信栈迁移到 XCom 通信栈：For a running group, follow this procedure to change the value of group_replication_communication_stack and the other required settings to migrate a group from the XCom communication stack to the MySQL communication stack, or from the MySQL communication stack to the XCom communication stack:

  1. 使用 STOP GROUP_REPLICATION 语句在每个组成员上停止组复制。最后停止主成员，这样可以避免触发新的主成员选举并必须等待完成。Stop Group Replication on each of the group members, using a STOP GROUP_REPLICATION statement. Stop the primary member last, so that you do not trigger a new primary election and have to wait for that to complete.

  2. 在每个组成员上，将系统变量 group_replication_communication_stack 设置为新的通信堆栈，根据需要选择 MYSQL 或 XCOM。您可以通过编辑 MySQL 服务器配置文件（通常在 Linux 和 Unix 系统上命名为 my.cnf，在 Windows 系统上为 my.ini），或者使用 SET 语句来实现。例如：On each of the group members, set the system variable group_replication_communication_stack to the new communication stack, MYSQL or XCOM as appropriate. You can do this by editing the MySQL Server configuration file (typically named my.cnf on Linux and Unix systems, or my.ini on Windows systems), or by using a SET statement. For example:

    SET PERSIST group_replication_communication_stack="MYSQL";

  3. 如果您正在将复制组从 XCom 通信堆栈（默认）迁移到 MySQL 通信堆栈，则在每个组成员上，按照上面列表中描述的方式，配置或重新配置所需的系统变量到适当的设置。例如，group_replication_local_address 系统变量必须设置为 MySQL 服务器正在监听的某个 IP 地址和端口。还需要使用 CHANGE REPLICATION SOURCE TO 语句配置任何网络命名空间。If you are migrating the replication group from the XCom communication stack (the default) to the MySQL communication stack, on each of the group members, configure or reconfigure the required system variables to appropriate settings, as described in the listing above. For example, the group_replication_local_address system variable must be set to one of the IP addresses and ports that MySQL Server is listening on. Also configure any network namespaces using a CHANGE REPLICATION SOURCE TO statement.

  4. 如果您正在将复制组从 XCom 通信栈（默认）迁移到 MySQL 通信栈，请在每个组成员上执行 GRANT 语句，以赋予复制用户帐户 GROUP_REPLICATION_STREAM 和 CONNECTION_ADMIN 权限。您需要将组成员从 Group Replication 停止时应用的只读状态中移出。同时确保通过在执行 GRANT 语句之前发出 SET SQL_LOG_BIN=0 来跳过每个组成员的二进制日志记录，并在之后发出 SET SQL_LOG_BIN=1，以确保本地事务不会干扰 Group Replication 的重新启动。例如：If you are migrating the replication group from the XCom communication stack (the default) to the MySQL communication stack, on each of the group members, issue GRANT statements to give the replication user account the GROUP_REPLICATION_STREAM and CONNECTION_ADMIN privileges. You will need to take the group members out of the read-only state that is applied when Group Replication is stopped. Also ensure that you skip binary logging on each group member by issuing SET SQL_LOG_BIN=0 before you issue the GRANT statements, and SET SQL_LOG_BIN=1 after them, so that the local transaction does not interfere with restarting Group Replication. For example:

    SET GLOBAL SUPER_READ_ONLY=OFF;
SET SQL_LOG_BIN=0; 
GRANT GROUP_REPLICATION_STREAM ON *.* TO rpl_user@'%';
GRANT CONNECTION_ADMIN ON *.* TO rpl_user@'%';
SET SQL_LOG_BIN=1;

  5. 如果您正在将复制组从 MySQL 通信堆栈迁移回 XCom 通信堆栈，请在每个组成员上，将上述要求中列出的系统变量重新配置为适合 XCom 通信堆栈的设置。第 20.9 节，“组复制变量” 列出了 XCom 通信堆栈的系统变量及其默认值和要求。If you are migrating the replication group from the MySQL communication stack back to the XCom communication stack, on each of the group members, reconfigure the system variables in the requirements listing above to settings suitable for the XCom communication stack. Section 20.9, “Group Replication Variables” lists the system variables with their defaults and requirements for the XCom communication stack.

    Note

  6. 要重新启动组，请按照第 20.5.2 节，“重新启动组”中的流程进行，该节解释了如何安全地引导已执行和已认证事务的组。必须由具有group_replication_bootstrap_group=ON 的服务器进行引导，以更改通信堆栈，因为所有成员都必须关闭。To restart the group, follow the process in Section 20.5.2, “Restarting a Group”, which explains how to safely bootstrap a group where transactions have been executed and certified. A bootstrap by a server with group_replication_bootstrap_group=ON is necessary to change the communication stack, because all of the members must be shut down.

  7. 成员现在通过新的通信栈互相连接。任何设置了 group_replication_communication_stack（或者在 XCom 的情况下使用默认值）为以前的通信栈的服务器将无法加入该组。需要注意的是，由于组复制甚至无法看到加入尝试，它不会检查并通过错误信息拒绝加入的成员。相反，当以前的通信栈在尝试联系新栈时放弃时，尝试加入将静默失败。Members now connect to each other using the new communication stack. Any server that has group_replication_communication_stack set (or defaulted, in the case of XCom) to the previous communication stack is no longer able to join the group. It is important to note that because Group Replication cannot even see the joining attempt, it does not check and reject the joining member with an error message. Instead, the attempted join fails silently when the previous communication stack gives up trying to contact the new one.

首页   上一级   下一节
Related Documentation
MySQL 8.4 Release Notes
Download this Manual
PDF (US Ltr) - 40.2Mb
PDF (A4) - 40.3Mb
Man Pages (TGZ) - 261.9Kb
Man Pages (Zip) - 367.4Kb
Info (Gzip) - 4.0Mb
Info (Zip) - 4.0Mb