MySQL Cluster Manager 9.2.0 User Manual
MySQL Cluster Manager 9.2 supports TLS Link Encryption for NDB Cluster, which is available for NDB Cluster 8.3.0 and later. This section describes a few scenarios for using MySQL Cluster Manager to configure or manage TLS connections in an NDB Cluster.
Create a site, package, and a cluster with the desired configuration—see Section 4.4, “Setting Up MySQL NDB Clusters with MySQL Cluster Manager” for instructions. Then follow the steps for a basic or a user-defined setup.
Basic setup.
Create the CA and certificates for the cluster; this also
defines
--ndb-tls-search-path
for any managed process in the cluster:
mcm> create certs mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Certificates created successfully | +-----------------------------------+ 1 row in set (8.56 sec)
Verify --ndb-tls-search-path
settings:
mcm> get -d ndb-tls*: mycluster; +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | Name | Value | Process1 | NodeId1 | Process2 | NodeId2 | Level | Comment | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndb_mgmd | 145 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 1 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 2 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 146 | | | | | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 147 | | | | | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ 5 rows in set (0.10 sec)
User-defined setup.
Set --ndb-tls-search-path (the
command is split into multiple lines for easy reading only; it
should be entered in a single line):
mcm> set
ndb_tls_search_path:ndb_mgmd=/foo/mcm_data/clusters/mycluster/certs,
ndb_tls_search_path:ndbmtd=/foo/mcm_data/clusters/mycluster/certs,
ndb_tls_search_path:mysqld=/foo/mcm_data/clusters/mycluster/certs
mycluster;
+-----------------------------------+
| Command result |
+-----------------------------------+
| Cluster reconfigured successfully |
+-----------------------------------+
1 row in set (3.17 sec)
Ensure --ndb-tls-search-path is
set correctly for all managed processes (and issue more
set commands for corrections, if
needed):
mcm> get -d ndb-tls*: mycluster; +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | Name | Value | Process1 | NodeId1 | Process2 | NodeId2 | Level | Comment | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndb_mgmd | 145 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 1 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 2 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 146 | | | | | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 147 | | | | | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ 5 rows in set (0.10 sec)
For both kinds of setups, create CA and certificates for the cluster (notice that the certificates are only loaded once by the processes at startup):
mcm> create certs mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Certificates created successfully | +-----------------------------------+ 1 row in set (8.56 sec)
Enable RequireTls for
ndb_mgmd and datanodes with another
set command.
mcm> set RequireTls:ndb_mgmd=true,RequireTls:ndbmtd=true mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (3.56 sec)
Optionally one may also enable
RequireCertificate,
or set --ndb-mgm-tls mode to
strict:
mcm> set RequireCertificate:ndb_mgmd=true,RequireCertificate:ndbmtd=true mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (2.53 sec) mcm> set ndb_mgm_tls:ndb_mgmd=strict,ndb_mgm_tls:ndbmtd=strict mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (2.39 sec)
Start the cluster:
mcm> start cluster mycluster; +------------------------------+ | Command result | +------------------------------+ | Cluster started successfully | +------------------------------+ 1 row in set (1 min 33.62 sec)
Cluster is now running with TLS enabled, required, and (optionally) with certificates required for peers, and in strict mode.
Assuming you have a cluster already created and started by MySQL Cluster Manager, follow these steps to enable TLS connections for it.
Ensure --ndb-tls-search-path is
set correctly for all managed processes, and issue the needed
set commands for corrections if
needed:
mcm> get -d ndb-tls*: mycluster; +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | Name | Value | Process1 | NodeId1 | Process2 | NodeId2 | Level | Comment | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndb_mgmd | 145 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 1 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | ndbmtd | 2 | | | | Command Line | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 146 | | | | | | ndb_tls_search_path | /foo/mcm_data/clusters/mycluster/certs | mysqld | 147 | | | | | +---------------------+----------------------------------------+----------+---------+----------+---------+-------+--------------+ 5 rows in set (0.10 sec)
Create the CA and certificates for the cluster using MySQL Cluster Manager:
mcm> create certs mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Certificates created successfully | +-----------------------------------+ 1 row in set (8.57 sec)
Restart the cluster so that processes load the certificates created (notice that the certificates are only loaded once by the processes at startup):
mcm> restart cluster mycluster; +--------------------------------+ | Command result | +--------------------------------+ | Cluster restarted successfully | +--------------------------------+ 1 row in set (1 min 38.09 sec)
Enable RequireTls for
ndb_mgmd and datanodes with another
set command:
mcm> set RequireTls:ndb_mgmd=true,RequireTls:ndbmtd=true mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (1 min 47.38 sec)
Cluster is now running with TLS enabled and required.
Optionally, one may also enable
RequireCertificate,
or set either --ndb-mgm-tls mode
to strict:
mcm> set RequireCertificate:ndb_mgmd=true,RequireCertificate:ndbmtd=true mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (1 min 42.53 sec) mcm> set ndb_mgm_tls:ndb_mgmd=strict,ndb_mgm_tls:ndbmtd=strict mycluster; +-----------------------------------+ | Command result | +-----------------------------------+ | Cluster reconfigured successfully | +-----------------------------------+ 1 row in set (1 min 48.13 sec)
Cluster is now running with TLS enabled, required, and (optionally) with certificates required for peers, and strict mode.