mysql/postgres support

[deniseschannon]

No description provided.

[huapox]

That wonderful, by the way with a suggest/question will k3s supports rqlite?

[erikwilson]

To test this enhancement I first created certs for etcd3 which include a SAN for 10.0.0.2 using the following instructions:
https://github.com/kelseyhightower/etcd-production-setup

etcd3

To launch an etcd3 server using those certs:

docker run --name etcd \
   -v `pwd`/etcd-ca:/etcd-ca \
   -p 127.0.0.1:2379:2379 \
   -p 127.0.0.1:2380:2380 \
   -e ALLOW_NONE_AUTHENTICATION=yes \
   -e ETCD_LISTEN_CLIENT_URLS=https://0.0.0.0:2379 \
   -e ETCD_ADVERTISE_CLIENT_URLS=https://10.0.2.2:2379 \
   -e ETCD_CERT_FILE=/etcd-ca/certs/etcd0.example.com.crt \
   -e ETCD_KEY_FILE=/etcd-ca/private/etcd0.example.com.key \
   -e ETCD_CA_FILE=/etcd-ca/certs/ca.crt \
   -d bitnami/etcd:latest

And from within a Valgrant alpine instance etcd3 tested with:

INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh \
   --storage-backend etcd3 \
   --storage-endpoint https://10.0.2.2:2379 \
   --storage-cafile `pwd`/etcd-ca/certs/ca.crt \
   --storage-certfile `pwd`/etcd-ca/certs/etcd-client.crt \
   --storage-keyfile `pwd`/etcd-ca/private/etcd-client.key

mysql

Launching a mysql service using the same etcd certs:

docker run --name mysql \
   -v `pwd`/etcd-ca/:/etcd-ca \
   -p 127.0.0.1:3306:3306 \
   -e MYSQL_ROOT_PASSWORD=secret \
   -d mysql:latest \
       --require-secure-transport=ON \
       --ssl-ca /etcd-ca/certs/ca.crt \
       --ssl-cert /etcd-ca/certs/etcd0.example.com.crt \
       --ssl-key /etcd-ca/private/etcd0.example.com.key

And from within a Valgrant alpine instance mysql tested with:

INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh \
   --storage-endpoint='mysql://root:secret@tcp(10.0.2.2:3306)/testdb' \
   --storage-cafile `pwd`/etcd-ca/certs/ca.crt \
   --storage-certfile `pwd`/etcd-ca/certs/etcd-client.crt \
   --storage-keyfile `pwd`/etcd-ca/private/etcd-client.key

postgres

Launching a postgres service using the same etcd certs:

docker run --name postgres \
   -v `pwd`/etcd-ca/:/etcd-ca \
   -p 127.0.0.1:5432:5432 \
   -e POSTGRES_USER=root \
   -e POSTGRES_PASSWORD=secret \
   -d postgres:latest \
      -c ssl=on \
      -c ssl_ca_file=/etcd-ca/certs/ca.crt \
      -c ssl_cert_file=/etcd-ca/certs/etcd0.example.com.crt \
      -c ssl_key_file=/etcd-ca/private/etcd0.example.com.key

And from within a Valgrant alpine instance postgres tested with:

INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh \
   --storage-endpoint='postgres://root:secret@10.0.2.2:5432/testdb' \
   --storage-cafile `pwd`/etcd-ca/certs/ca.crt \
   --storage-certfile `pwd`/etcd-ca/certs/etcd-client.crt \
   --storage-keyfile `pwd`/etcd-ca/private/etcd-client.key