dm: add LOCK TABLES privilege note for managed MySQL sources by qiancai · Pull Request #21467 · pingcap/docs-cn

qiancai · 2026-03-26T02:21:46Z

This PR is translated from: pingcap/docs#22605

What is changed, added or deleted?

Added conditional LOCK TABLES privilege documentation for managed MySQL sources (Amazon RDS, Aurora, Google Cloud SQL) across three DM docs pages.

Background: DM defaults to consistency=auto. On managed MySQL where FLUSH TABLES WITH READ LOCK is restricted by the cloud provider, DM falls back to LOCK TABLES. This privilege is not needed on self-managed MySQL instances. Confirmed with @GMHDBJD (Minghao Guo): the FTWRL → LOCK TABLES fallback in auto mode is by design.

Changes:

dm/dm-precheck.md: Clarified that LOCK TABLES is needed for auto fallback on managed MySQL, not just flush/lock
dm/dm-worker-intro.md: Added LOCK TABLES to privilege table with managed-MySQL scope note; added conditional GRANT example
dm/quick-start-with-dm.md: Added note pointing to dm-worker-intro for managed MySQL sources (×2 instances)

Evidence: Lab-06: LOCK TABLES privilege testing (9 scenarios, vanilla MySQL vs RDS)

Related:

Cloud DM docs: cloud/dm: add LOCK TABLES to source privilege prerequisites docs#22598
Pre-check improvement: https://tidb.atlassian.net/browse/DM-12687

Which TiDB version(s) do your changes apply to?

master (dev)
v8.5 (LTS)

cc @GMHDBJD @qiancai @OliverS929

ti-chi-bot · 2026-03-26T02:21:54Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign qiancai for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dm/dm-worker-intro.md

dm/dm-precheck.md

dm/dm-worker-intro.md

dm/quick-start-with-dm.md

ti-chi-bot · 2026-03-26T02:39:46Z

@qiancai: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-verify	`20fe9cd`	link	true	`/test pull-verify`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

hfxsd · 2026-03-26T12:59:47Z

dm/dm-precheck.md

@@ -67,8 +67,12 @@ tiup dmctl check-task ./task.yaml
 * （必须）上游数据库的 dump 权限

    - 检查是否有 INFORMATION_SCHEMA 和 dump 表的 SELECT 权限。


Suggested change

- 检查是否有 INFORMATION_SCHEMA 和 dump 表的 SELECT 权限。

- 检查是否有 `INFORMATION_SCHEMA` 和 dump 表的 `SELECT` 权限。

hfxsd · 2026-03-26T12:59:56Z

dm/dm-precheck.md

    - 检查是否有 INFORMATION_SCHEMA 和 dump 表的 SELECT 权限。
-    - 如果 consistency=flush，将检查是否有 RELOAD 权限。
-    - 如果 consistency=flush/lock，将检查是否有 dump 表的 LOCK TABLES 权限。
+    - 如果 `consistency=flush`，将检查是否有 RELOAD 权限。


Suggested change

- 如果 `consistency=flush`，将检查是否有 RELOAD 权限。

- 如果 `consistency=flush`，将检查是否有 `RELOAD` 权限。

hfxsd · 2026-03-26T13:01:03Z

dm/dm-precheck.md

+
+    > **注意：**
+    >
+    > 当 `consistency=auto`（默认值）时，DM 会首先尝试执行 `FLUSH TABLES WITH READ LOCK`（FTWRL）。如果 FTWRL 不可用，DM 会回退使用 `LOCK TABLES`。这种回退在托管型 MySQL 服务中较为常见（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 和 Google Cloud SQL），因为这些服务通常不允许执行 FTWRL。在这种情况下，运行时需要具备 `LOCK TABLES` 权限，但当前的 precheck 并不会验证该权限。完整的权限列表，请参见[上游数据库用户权限](/dm/dm-worker-intro.md#上游数据库用户权限)。


Suggested change

> 当 `consistency=auto`（默认值）时，DM 会首先尝试执行 `FLUSH TABLES WITH READ LOCK`（FTWRL）。如果 FTWRL 不可用，DM 会回退使用 `LOCK TABLES`。这种回退在托管型 MySQL 服务中较为常见（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 和 Google Cloud SQL），因为这些服务通常不允许执行 FTWRL。在这种情况下，运行时需要具备 `LOCK TABLES` 权限，但当前的 precheck 并不会验证该权限。完整的权限列表，请参见[上游数据库用户权限](/dm/dm-worker-intro.md#上游数据库用户权限)。

> 当 `consistency=auto`（默认值）时，DM 会首先尝试执行 `FLUSH TABLES WITH READ LOCK` (FTWRL)。如果 FTWRL 不可用，DM 会回退使用 `LOCK TABLES`。这种回退在托管型 MySQL 服务中较为常见（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 和 Google Cloud SQL），因为这些服务通常不允许执行 FTWRL。在这种情况下，运行时需要具备 `LOCK TABLES` 权限，但当前的 precheck 并不会验证该权限。完整的权限列表，请参见[上游数据库用户权限](/dm/dm-worker-intro.md#上游数据库用户权限)。

hfxsd · 2026-03-26T13:02:26Z

dm/dm-worker-intro.md


+> **注意：**
+>
+> 如果从托管型 MySQL 服务（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 或 Google Cloud SQL）迁移数据，且该服务不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL），还需要授予 `LOCK TABLES` 权限。使用默认的 `consistency=auto` 设置时，如果 FTWRL 不可用，DM 会回退到 `LOCK TABLES`。


Suggested change

> 如果从托管型 MySQL 服务（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 或 Google Cloud SQL）迁移数据，且该服务不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL），还需要授予 `LOCK TABLES` 权限。使用默认的 `consistency=auto` 设置时，如果 FTWRL 不可用，DM 会回退到 `LOCK TABLES`。

> 如果从托管型 MySQL 服务（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 或 Google Cloud SQL）迁移数据，且该服务不允许执行 `FLUSH TABLES WITH READ LOCK` (FTWRL)，还需要授予 `LOCK TABLES` 权限。使用默认的 `consistency=auto` 设置时，如果 FTWRL 不可用，DM 会回退到 `LOCK TABLES`。

hfxsd · 2026-03-26T13:02:39Z

dm/dm-worker-intro.md

 GRANT SELECT ON db1.* TO 'your_user'@'your_wildcard_of_host';
 ```

+如果从不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL）的托管型 MySQL 服务迁移数据，还需要授予 `LOCK TABLES` 权限：


Suggested change

如果从不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL）的托管型 MySQL 服务迁移数据，还需要授予 `LOCK TABLES` 权限：

如果从不允许执行 `FLUSH TABLES WITH READ LOCK` (FTWRL) 的托管型 MySQL 服务迁移数据，还需要授予 `LOCK TABLES` 权限：

ti-chi-bot · 2026-03-26T13:03:04Z

[LGTM Timeline notifier]

Timeline:

2026-03-26 13:03:04.322744981 +0000 UTC m=+446180.358815251: ☑️ agreed by hfxsd.

docs: translate #22605

2b12863

qiancai added needs-cherry-pick-release-8.5 Should cherry pick this PR to release-8.5 branch. translation/from-docs This PR is translated from a PR in pingcap/docs. labels Mar 26, 2026

ti-chi-bot bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Mar 26, 2026

qiancai commented Mar 26, 2026

View reviewed changes

dm/dm-worker-intro.md Outdated Show resolved Hide resolved

Update dm/dm-worker-intro.md

592c032

qiancai commented Mar 26, 2026

View reviewed changes

dm/dm-precheck.md Outdated Show resolved Hide resolved

Update dm/dm-precheck.md

26aad30

qiancai commented Mar 26, 2026

View reviewed changes

dm/dm-precheck.md Outdated Show resolved Hide resolved

qiancai commented Mar 26, 2026

View reviewed changes

dm/dm-worker-intro.md Outdated Show resolved Hide resolved

dm/dm-worker-intro.md Outdated Show resolved Hide resolved

dm/quick-start-with-dm.md Outdated Show resolved Hide resolved

dm/quick-start-with-dm.md Outdated Show resolved Hide resolved

Apply suggestions from code review

20fe9cd

qiancai self-assigned this Mar 26, 2026

hfxsd self-requested a review March 26, 2026 02:43

hfxsd reviewed Mar 26, 2026

View reviewed changes

hfxsd approved these changes Mar 26, 2026

View reviewed changes

ti-chi-bot bot added the needs-1-more-lgtm Indicates a PR needs 1 more LGTM. label Mar 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dm: add LOCK TABLES privilege note for managed MySQL sources#21467

dm: add LOCK TABLES privilege note for managed MySQL sources#21467
qiancai wants to merge 4 commits intopingcap:masterfrom
qiancai:translate/fix/dm-lock-tables-managed-mysql

qiancai commented Mar 26, 2026

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -67,8 +67,12 @@ tiup dmctl check-task ./task.yaml
		* （必须）上游数据库的 dump 权限

		- 检查是否有 INFORMATION_SCHEMA 和 dump 表的 SELECT 权限。

	- 检查是否有 INFORMATION_SCHEMA 和 dump 表的 SELECT 权限。
	- 检查是否有 `INFORMATION_SCHEMA` 和 dump 表的 `SELECT` 权限。

	- 如果 `consistency=flush`，将检查是否有 RELOAD 权限。
	- 如果 `consistency=flush`，将检查是否有 `RELOAD` 权限。

	> 如果从托管型 MySQL 服务（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 或 Google Cloud SQL）迁移数据，且该服务不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL），还需要授予 `LOCK TABLES` 权限。使用默认的 `consistency=auto` 设置时，如果 FTWRL 不可用，DM 会回退到 `LOCK TABLES`。
	> 如果从托管型 MySQL 服务（例如 Amazon RDS、Aurora、ApsaraDB RDS for MySQL、Azure Database for MySQL 或 Google Cloud SQL）迁移数据，且该服务不允许执行 `FLUSH TABLES WITH READ LOCK` (FTWRL)，还需要授予 `LOCK TABLES` 权限。使用默认的 `consistency=auto` 设置时，如果 FTWRL 不可用，DM 会回退到 `LOCK TABLES`。

	如果从不允许执行 `FLUSH TABLES WITH READ LOCK`（FTWRL）的托管型 MySQL 服务迁移数据，还需要授予 `LOCK TABLES` 权限：
	如果从不允许执行 `FLUSH TABLES WITH READ LOCK` (FTWRL) 的托管型 MySQL 服务迁移数据，还需要授予 `LOCK TABLES` 权限：

Conversation

qiancai commented Mar 26, 2026

What is changed, added or deleted?

Which TiDB version(s) do your changes apply to?

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

Uh oh!

hfxsd Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

hfxsd Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

hfxsd Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

hfxsd Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

hfxsd Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

ti-chi-bot bot commented Mar 26, 2026

[LGTM Timeline notifier]

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants