Excessive logging: [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

[evanstucker-hates-2fa]

Name and Version

bitnami/mysql 9.11.1

What architecture are you using?

amd64

What steps will reproduce the bug?

Install with default values:

helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-mysql bitnami/mysql --version 9.11.1

Check logs:

kubectl logs -f my-mysql-0

Are you using any custom parameters or values?

No

What is the expected behavior?

No excessive logging.

What do you see instead?

Logging will show this error message twice every 10 seconds:

[Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

Additional information

I tried to fix it with this values file - this is the default primary.configuration with one change - I updated default_authentication_plugin=caching_sha2_password:

$ cat test.yaml
primary:
  configuration: |-
    [mysqld]
    default_authentication_plugin=caching_sha2_password
    skip-name-resolve
    explicit_defaults_for_timestamp
    basedir=/opt/bitnami/mysql
    plugin_dir=/opt/bitnami/mysql/lib/plugin
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    datadir=/bitnami/mysql/data
    tmpdir=/opt/bitnami/mysql/tmp
    max_allowed_packet=16M
    bind-address=*
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    log-error=/opt/bitnami/mysql/logs/mysqld.log
    character-set-server=UTF8
    collation-server=utf8_general_ci
    slow_query_log=0
    long_query_time=10.0

    [client]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    default-character-set=UTF8
    plugin_dir=/opt/bitnami/mysql/lib/plugin

    [manager]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid

Installed again with:

$ helm install yourmoms-mysql bitnami/mysql --version 9.11.1 --values test.yaml

Checking logs again:

kubectl logs -f yourmoms-mysql-0

Seems like updating default_authentication_plugin fixes it!

[evanstucker-hates-2fa]

Interestingly, if you do a default install:

helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-mysql bitnami/mysql --version 9.11.1

Then upgrade it with the test.yaml above:

helm upgrade my-mysql bitnami/mysql --version 9.11.1 --values test.yaml

It does not completely fix the problem. I still see one warning message every 10 seconds (instead of two.)

[evanstucker-hates-2fa]

I'm creating a PR to at least fix the defaults in values.yaml so new installs won't have this issue.

[evanstucker-hates-2fa]

May need to run a SQL query against all users to fix it on existing releases?
https://stackoverflow.com/questions/61809615/sha256-password-deprecated-warnings-filling-logs
I'll test this tomorrow. If it works, I'm not sure how to automate that in this chart...

[carrodher]

Thank you for opening this issue and submitting the associated Pull Request. Our team will review and provide feedback. Once the PR is merged, the issue will automatically close.

Your contribution is greatly appreciated!

[evanstucker-hates-2fa]

I suppose we need to ask, "should we make this change?" I don't know enough about MySQL. Partial discussion in this post: https://stackoverflow.com/questions/49963383/authentication-plugin-caching-sha2-password

[evanstucker-hates-2fa]

Official docs: https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

[seel93]

This is still an issue on version: 9.14.1

helm upgrade mysql bitnami/mysql --values values.yml --version 9.14.1

using the values provided above

[kfirfer]

Still reproduces version chart : 9.16.0

[myl82]

Still present in v. 9.16.1, MySQL-8.0.35
Tried to fix it like from first post, but when try to restroe DB got error:
ERROR 1045 (28000): Plugin caching_sha2_password could not be loaded: Error loading shared library /usr/lib/mariadb/plugin/caching_sha2_password.so: No such file or directory

Looks like plugin is absent in image, not working "out from the box" :(

[neffets]

helm chart 9.16.1 no plugin for sha2 available

$ ls -al /opt/bitnami/mysql/lib/plugin/ |egrep -e '(cach|sha|auth)'
-rw-r--r-- 1 root root 21040 Oct 25 10:28 auth.so
-rw-r--r-- 1 root root 18912 Oct 25 10:28 auth_socket.so
-rw-r--r-- 1 root root 25232 Oct 25 10:28 auth_test_plugin.so
-rw-r--r-- 1 root root 7799968 Oct 25 10:32 authentication_kerberos_client.so
-rw-r--r-- 1 root root 7635368 Oct 25 10:28 authentication_ldap_sasl_client.so
-rw-r--r-- 1 root root 8400576 Oct 25 10:28 authentication_oci_client.so
-rw-r--r-- 1 root root 280208 Oct 25 10:29 component_reference_cache.so
-rw-r--r-- 1 root root 17656 Oct 25 10:28 qa_auth_client.so
-rw-r--r-- 1 root root 20752 Oct 25 10:28 qa_auth_interface.so
-rw-r--r-- 1 root root 19184 Oct 25 10:28 qa_auth_server.so

[FraPazGal]

Hello @myl82, I'm not sure what config are you using in your chart but by the /usr/lib/mariadb path in your shared message it looks like you are not using an out of the box bitnami/mysql chart installation.

Regarding your concern @neffets, I reviewed mysql's documentation and it explicitly says "The caching_sha2_password plugin [...] is built into the server, need not be loaded explicitly, and cannot be disabled by unloading it". As such, it is normal for it not to be at /opt/bitnami/mysql/lib/plugin/. Moreover, the default mysql_native_password is not there either.

Please try installing the chart with the following configuration set:

$ helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password

I've checked and that should solve the annoying warnings in the logs and make your mysql instance use caching_sha2_password from the get-go.

[malupo]

$ helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password

that does not work. still seeing message:
[Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

[FraPazGal]

That is weird @malupo, I double-checked and it seems to be working on my side. Are you installing the chart in a fresh namespace? You may be using a persistent volume (PV) from a prior installation where users were created with the old auth plugin. To make sure, please try using one of the following installations:

• Installing the chart in a new namespace

$ helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password -n test-mysql --create-namespace
$ kubectl get logs mysql-0 -f -n test-mysql

• Installing it after manually removing any dangling persistent volume claims from mysql

$ helm uninstall mysql
$ kubectl delete pvc data-mysql-0
$ helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password
$ kubectl get logs mysql-0 -f

If the problem persists please share any relevant cluster or chart custom config you may be using.

[malupo]

1. I totally deleted PV, PVCs and namespaces

C:\Users\xxxx>k get pvc -A
No resources found

C:\Users\xxxx>k get pv -A
No resources found

2. I created test-mysql namespace
3. kubens test-mysql
4. I issued "helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password"
5. message persists:

2024-01-18T17:30:17.906671Z 36 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

[malupo]

Problem is not present in version 9.1.4 but it certainly is in the latest version (9.17.1).
FraPazGal -- have you tried a helm install with version 9.17.1 and is the message not present when setting option "--set auth.defaultAuthenticationPlugin=caching_sha2_password" ??

[FraPazGal]

Hello @malupo, I am indeed using the latest version and used the auth.defaultAuthenticationPlugin parameter. Using that param in chart version 9.1.4 wouldn't make a difference as the change was introduced in 9.13.0. See: #19577

Could you do a helm template and check if the configmap template has caching_sha2_password in its data?

$ helm template mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password --version 9.18.0
...
# Source: mysql/templates/primary/configmap.yaml
apiVersion: v1
kind: ConfigMap
...
data:
  my.cnf: |-
    [mysqld]
    default_authentication_plugin=caching_sha2_password

[malupo]

Yes that value is there. “default_authentication_plugin=caching_sha2_password” But the problem is that it does not work and there hence there is a bug in MYSQL. Even with that value changed, the message 2024-01-22T16:16:04.630721Z 8 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: 'mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead still comes out. Please retest to see error and appropriately advise.

[malupo]

C:\Users\xxxxx>k exec mysql-0 -it /bin/sh kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. $ mysql --verbose --help | grep -A 1 "Default options" Default options are read from the following files in the given order: /etc/my.cnf /etc/mysql/my.cnf /opt/bitnami/mysql/conf/my.cnf ~/.my.cnf cat /opt/bitnami/mysql/conf/my.cnf [mysqld] default_authentication_plugin=caching_sha2_password skip-name-resolve explicit_defaults_for_timestamp basedir=/opt/bitnami/mysql plugin_dir=/opt/bitnami/mysql/lib/plugin port=3306 socket=/opt/bitnami/mysql/tmp/mysql.sock datadir=/bitnami/mysql/data tmpdir=/opt/bitnami/mysql/tmp max_allowed_packet=16M bind-address=* pid-file=/opt/bitnami/mysql/tmp/mysqld.pid log-error=/opt/bitnami/mysql/logs/mysqld.log character-set-server=UTF8 slow_query_log=0 long_query_time=10.0 [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

[FraPazGal]

Hello @malupo, I can't reproduce the issue on my side. I've deployed the chart again using the params I shared in my last message and there is no warning involved. I double-checked this by looking into the auth plugins each database user was using:

$ helm install mysql bitnami/mysql --set auth.defaultAuthenticationPlugin=caching_sha2_password
$ kubectl exec mysql-0 -- bash
I have no name!@mysql-0:/$ mysql -h mysql -u root -p
mysql> select user, plugin from mysql.user;
+------------------+-----------------------+
| user             | plugin                |
+------------------+-----------------------+
| root             | caching_sha2_password |
| mysql.infoschema | caching_sha2_password |
| mysql.session    | caching_sha2_password |
| mysql.sys        | caching_sha2_password |
+------------------+-----------------------+
4 rows in set (0.00 sec)

I would suggest retrying the above solutions using a fresh K8s cluster but if the problem persists you can modify the used plugin manually:

$ helm install mysql bitnami/mysql
$ kubectl exec mysql-0 -- bash
I have no name!@mysql-0:/$ mysql -h mysql -u root -p
mysql> select user, plugin from mysql.user;
+------------------+-----------------------+
| user             | plugin                |
+------------------+-----------------------+
| root             | mysql_native_password |
| mysql.infoschema | caching_sha2_password |
| mysql.session    | caching_sha2_password |
| mysql.sys        | caching_sha2_password |
+------------------+-----------------------+
4 rows in set (0.01 sec)

mysql> ALTER USER 'root' IDENTIFIED WITH caching_sha2_password BY 'iZp1l73a8j';
Query OK, 0 rows affected (0.01 sec)

mysql> select user, plugin from mysql.user;
+------------------+-----------------------+
| user             | plugin                |
+------------------+-----------------------+
| root             | caching_sha2_password |
| mysql.infoschema | caching_sha2_password |
| mysql.session    | caching_sha2_password |
| mysql.sys        | caching_sha2_password |
+------------------+-----------------------+
4 rows in set (0.00 sec)

[malupo]

Deleting my cluster and recreating solved the issue. It must have been a setting or artifact that had been dangling in my cluster somewhere. One note: When trying to connect via the external app MYSQL Workbench --- getting message: “Failed to connect to mysql at mysql:3306 with user: root. Authentication plugin ‘caching_sha2_password’ cannot be loaded. The specified module could not be found.” However programmatic access to Mysql via python code works correctly.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.