feat: support account provision for tidb

addons/tidb/scripts/tidb_accountprovision.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -ex
+
+eval statement=\"${KB_ACCOUNT_STATEMENT}\"
+mysql -h127.0.0.1 -P"$TIDB_PORT" -u root -p"$TIDB_ROOT_PASSWORD" -e "${statement}"

addons/tidb/scripts/tidb_postprovision.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -ex
+
+mysql -h127.0.0.1 -P"$TIDB_PORT" -u root -e "set password for 'root'@'%' = '$TIDB_ROOT_PASSWORD'"

addons/tidb/templates/componentdefinition-tidb.yaml

@@ -36,6 +36,16 @@ spec:
             name: client
     - name: PD_ADDRESS
       value: "$(PD_HOST).$(CLUSTER_NAMESPACE).svc{{ .Values.clusterDomain }}:$(PD_PORT)"
+    - name: TIDB_PORT
+      valueFrom:
+        serviceVarRef:
+          port:
+            name: client
+    - name: TIDB_ROOT_PASSWORD
+      valueFrom:
+        credentialVarRef:
+          name: root
+          password: Required
   runtime:
     containers:
       - name: tidb
@@ -91,17 +101,36 @@ spec:
       constraintRef: {{ include "tidb.tidb.configConstraintName" . }}
       namespace: {{ .Release.Namespace }}
       volumeName: config
-  # TODO: account provision is unsupported for now because lorry doesn't support accountProvision lifecycle action
-  # systemAccounts:
-  #   - name: root
-  # lifecycleActions:
-  #   accountProvision:
-  #     exec:
-  #       image: {{ .Values.image.registry | default "docker.io" }}/imega/mysql-client:10.6.4
-  #       command:
-  #       - mysql
-  #       args:
-  #       - 
+  systemAccounts:
+    - name: root
+      initAccount: true
+      passwordGenerationPolicy: &defaultPasswordGenerationPolicy
+        length: 16
+        numDigits: 5
+        numSymbols: 0
+        letterCase: MixedCases
+    - name: kbadmin
+      passwordGenerationPolicy: *defaultPasswordGenerationPolicy
+      statement:
+        create: CREATE USER '${KB_ACCOUNT_NAME}'@'%' IDENTIFIED BY '${KB_ACCOUNT_PASSWORD}';GRANT ALL PRIVILEGES ON *.* TO '${KB_ACCOUNT_NAME}'@'%';
+  lifecycleActions:
+    postProvision:
+      preCondition: RuntimeReady
+      exec:
+        image: {{ .Values.image.registry | default "docker.io" }}/arey/mysql-client:latest
+        command:
+          - sh
+          - -c
+          - |
+            {{- .Files.Get "scripts/tidb_postprovision.sh" | nindent 12 }}
+    accountProvision:
+      exec:
+        image: {{ .Values.image.registry | default "docker.io" }}/arey/mysql-client:latest
+        command:
+          - sh
+          - -c
+          - |
+            {{- .Files.Get "scripts/tidb_accountprovision.sh" | nindent 12 }}
   exporter:
     containerName: tidb
     scrapePort: "10080"