只有在使用 XCom 通信栈建立组通信时（group_replication_communication_stack=XCOM），Group Replication 插件才允许你指定一个允许列表，来自该列表中的主机可以建立传入的组通信系统连接。如果你在服务器 s1 上指定了允许列表，那么当服务器 s2 出于参与组通信的目的尝试连接 s1 时，s1 会首先检查允许列表，然后才决定是否接受 s2 的连接。如果 s2 在允许列表中，s1 则接受该连接，否则 s1 会拒绝 s2 的连接尝试。系统变量 group_replication_ip_allowlist 用于指定允许列表。When and only when the XCom communication stack is used for establishing group communications (group_replication_communication_stack=XCOM), the Group Replication plugin lets you specify an allowlist of hosts from which an incoming Group Communication System connection can be accepted. If you specify an allowlist on a server s1, then when server s2 is establishing a connection to s1 for the purpose of engaging group communication, s1 first checks the allowlist before accepting the connection from s2. If s2 is in the allowlist, then s1 accepts the connection, otherwise s1 rejects the connection attempt by s2. The system variable group_replication_ip_allowlist is used to specify the allowlist.

如果您没有明确指定允许列表，组通信引擎（XCom）会自动扫描主机上的活动接口，并识别具有私有子网地址的接口，以及为每个接口配置的子网掩码。这些地址，以及 IPv4 和 IPv6 的 localhost IP 地址，会用于创建自动的组复制允许列表。因此，自动允许列表包括在应用适当的子网掩码后，主机在以下范围内找到的任何 IP 地址：If you do not specify an allowlist explicitly, the group communication engine (XCom) automatically scans active interfaces on the host, and identifies those with addresses on private subnetworks, together with the subnet mask that is configured for each interface. These addresses, and the localhost IP address for IPv4 and IPv6 are used to create an automatic Group Replication allowlist. The automatic allowlist therefore includes any IP addresses that are found for the host in the following ranges after the appropriate subnet mask has been applied:

IPv4 (as defined in RFC 1918)
10/8 prefix       (10.0.0.0 - 10.255.255.255) - Class A
172.16/12 prefix  (172.16.0.0 - 172.31.255.255) - Class B
192.168/16 prefix (192.168.0.0 - 192.168.255.255) - Class C

IPv6 (as defined in RFC 4193 and RFC 5156)
fc00:/7 prefix    - unique-local addresses
fe80::/10 prefix  - link-local unicast addresses

127.0.0.1 - localhost for IPv4
::1       - localhost for IPv6

会在错误日志中添加一条记录，说明已自动允许该主机的地址。An entry is added to the error log stating the addresses that have been allowed automatically for the host.

私有地址的自动允许列表不能用于来自私有网络之外的服务器的连接，因此即使服务器具有公共 IP 的接口，默认情况下也不允许来自外部主机的组复制连接。对于位于不同机器的服务器实例之间的组复制连接，您必须提供公共 IP 地址并将其明确指定为允许列表。如果指定了允许列表中的任意条目，私有地址和 localhost 地址不会被自动添加，因此如果使用这些地址，必须显式指定它们。The automatic allowlist of private addresses cannot be used for connections from servers outside the private network, so a server, even if it has interfaces on public IPs, does not by default allow Group Replication connections from external hosts. For Group Replication connections between server instances that are on different machines, you must provide public IP addresses and specify these as an explicit allowlist. If you specify any entries for the allowlist, the private and localhost addresses are not added automatically, so if you use any of these, you must specify them explicitly.

要手动指定允许列表，请使用 group_replication_ip_allowlist 系统变量。您可以在组复制运行时更改该列表。To specify an allow list manually, use the group_replication_ip_allowlist system variable. You can change the list while Group Replication is running.

允许列表必须包含每个成员的 group_replication_local_address 系统变量中指定的 IP 地址或主机名。此地址不同于 MySQL 服务器的 SQL 协议主机和端口，也未在服务器实例的 bind_address 系统变量中指定。如果作为服务器实例的 Group Replication 本地地址的主机名解析为 IPv4 和 IPv6 地址，Group Replication 连接将优先使用 IPv4 地址。The allowlist must contain the IP address or host name that is specified in each member's group_replication_local_address system variable. This address is not the same as the MySQL server SQL protocol host and port, and is not specified in the bind_address system variable for the server instance. If a host name used as the Group Replication local address for a server instance resolves to both an IPv4 and an IPv6 address, the IPv4 address is preferred for Group Replication connections.

指定为分布式恢复端点的 IP 地址，以及成员用于分布式恢复的标准 SQL 客户端连接的 IP 地址（如果使用该连接，这是默认设置），不需要添加到允许列表中。允许列表仅适用于每个成员指定的 group_replication_local_address 地址。加入的成员必须通过允许列表允许其与组的初始连接，以便获取用于分布式恢复的一个或多个地址。IP addresses specified as distributed recovery endpoints, and the IP address for the member's standard SQL client connection if that is used for distributed recovery (which is the default), do not need to be added to the allowlist. The allowlist is only for the address specified by group_replication_local_address for each member. A joining member must have its initial connection to the group permitted by the allowlist in order to retrieve the address or addresses for distributed recovery.

在允许列表中，您可以指定以下任意组合：In the allowlist, you can specify any combination of the following:

主机名可以解析为 IPv4 地址、IPv6 地址，或两者兼有。如果一个主机名同时解析为 IPv4 和 IPv6 地址，则 Group Replication 连接始终使用 IPv4 地址。您可以将 CIDR 表示法与主机名或 IP 地址结合使用，以允许具有特定网络前缀的 IP 地址块，但请确保指定子网中的所有 IP 地址都在您的控制范围内。Host names can resolve to IPv4 addresses, IPv6 addresses, or both. If a host name resolves to both an IPv4 and an IPv6 address, the IPv4 address is always used for Group Replication connections. You can use CIDR notation in combination with host names or IP addresses to permit a block of IP addresses with a particular network prefix, but do ensure that all the IP addresses in the specified subnet are under your control.

允许列表中的每个条目必须用逗号分隔。例如：A comma must separate each entry in the allowlist. For example:

mysql> SET GLOBAL group_replication_ip_allowlist="192.0.2.21/24,198.51.100.44,203.0.113.0/24,2001:db8:85a3:8d3:1319:8a2e:370:7348,example.org,www.example.com/24";

要加入复制组，服务器需要在它请求加入的种子成员上被允许。通常，这将是复制组的引导成员，但它也可以是加入组的服务器配置中通过 group_replication_group_seeds 选项列出的任何服务器。如果组的任何种子成员在 group_replication_group_seeds 选项中使用 IPv6 地址，而加入的成员使用的是 IPv4 group_replication_local_address，或者反之，也必须为加入的成员设置并允许一个备用地址，用于种子成员提供的协议（或能解析为该协议地址的主机名）。这是因为当服务器加入复制组时，它必须使用种子成员在 group_replication_group_seeds 选项中宣传的协议进行初始接触，无论该协议是 IPv4 还是 IPv6。如果加入的成员没有适用于相应协议的允许地址，则其连接尝试会被拒绝。有关管理混合 IPv4 和 IPv6 复制组的更多信息，请参见 第 20.5.5 节，“对 IPv6 及混合 IPv6 和 IPv4 组的支持”。To join a replication group, a server needs to be permitted on the seed member to which it makes the request to join the group. Typically, this would be the bootstrap member for the replication group, but it can be any of the servers listed by the group_replication_group_seeds option in the configuration for the server joining the group. If any of the seed members for the group are listed in the group_replication_group_seeds option with an IPv6 address when a joining member has an IPv4 group_replication_local_address, or the reverse, you must also set up and permit an alternative address for the joining member for the protocol offered by the seed member (or a host name that resolves to an address for that protocol). This is because when a server joins a replication group, it must make the initial contact with the seed member using the protocol that the seed member advertises in the group_replication_group_seeds option, whether that is IPv4 or IPv6. If a joining member does not have a permitted address for the appropriate protocol, its connection attempt is refused. For more information on managing mixed IPv4 and IPv6 replication groups, see Section 20.5.5, “Support For IPv6 And For Mixed IPv6 And IPv4 Groups”.

当复制组被重新配置时（例如，当选举出新的主节点或有成员加入或离开时），组成员会重新建立彼此之间的连接。如果某个组成员只能被在重新配置后不再是复制组成员的服务器允许，它将无法重新连接到复制组中不允许它的其余服务器。为了完全避免这种情况，请为复制组中的所有服务器指定相同的允许列表。When a replication group is reconfigured (for example, when a new primary is elected or a member joins or leaves), the group members re-establish connections between themselves. If a group member is only permitted by servers that are no longer part of the replication group after the reconfiguration, it is unable to reconnect to the remaining servers in the replication group that do not permit it. To avoid this scenario entirely, specify the same allowlist for all servers that are members of the replication group.

对于主机名，只有在另一台服务器发出连接请求时才会进行名称解析。无法解析的主机名不会被考虑进行允许列表验证，并且会向错误日志写入警告信息。对于已解析的主机名，将进行正向确认的反向 DNS (FCrDNS) 验证。For host names, name resolution takes place only when a connection request is made by another server. A host name that cannot be resolved is not considered for allowlist validation, and a warning message is written to the error log. Forward-confirmed reverse DNS (FCrDNS) verification is carried out for resolved host names.