Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use stats database for proxysql backends count #12555

Merged

Conversation

aymeric-ledizes
Copy link
Contributor

@aymeric-ledizes aymeric-ledizes commented Jul 20, 2022

What does this PR do?

This PR will change the query for the proxysql.backends.count metric from a query in a runtime table (admin-admin_credentials required) to a query in a stats table (allowing admin-stats_credentials only)

Motivation

Query in the runtime_mysql_servers table require admin credential by default. Runtime tables such as runtime_mysql_users contains sensitive data so it is not recommended to use admin-admin_credentials nor grant permissions.

While we can get the relevant data about backends count from the stats table stats_mysql_connection_pool we can update the query to this table instead.

Additional Notes

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • PR title must be written as a CHANGELOG entry (see why)
  • Files changes must correspond to the primary purpose of the PR as described in the title (small unrelated changes should have their own PR)
  • PR must have changelog/ and integration/ labels attached

@aymeric-ledizes aymeric-ledizes requested a review from a team as a code owner July 20, 2022 17:09
@codecov
Copy link

codecov bot commented Jul 20, 2022

Codecov Report

Merging #12555 (b5653bc) into master (1e32d0f) will not change coverage.
The diff coverage is n/a.

Flag Coverage Δ
proxysql 98.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@@ -236,9 +236,9 @@

STATS_MYSQL_BACKENDS = {
'name': 'stats_mysql_backends',
'query': 'SELECT hostgroup_id, status, COUNT(*) FROM runtime_mysql_servers GROUP BY hostgroup_id, status',
'query': 'SELECT hostgroup, status, COUNT(*) FROM stats_mysql_connection_pool GROUP BY hostgroup, status',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just checked and I confirm @aymeric-ledizes's analysis:
=> using the (unprivileged) stats user, the (old) table is not accessible, and your "new" table is working fine

cf: this test on my proxysql admin socket:

$ mysql -ustats -pstats -h127.0.0.1 -P6032
mysql> show tables;
+--------------------------------------+
| tables                               |
+--------------------------------------+
| global_variables                     |
| stats_memory_metrics                 |
| stats_mysql_commands_counters        |
| stats_mysql_connection_pool          |
| stats_mysql_connection_pool_reset    |
| stats_mysql_errors                   |
| stats_mysql_errors_reset             |
| stats_mysql_free_connections         |
| stats_mysql_global                   |
| stats_mysql_gtid_executed            |
| stats_mysql_prepared_statements_info |
| stats_mysql_processlist              |
| stats_mysql_query_digest             |
| stats_mysql_query_digest_reset       |
| stats_mysql_query_rules              |
| stats_mysql_users                    |
| stats_proxysql_servers_checksums     |
| stats_proxysql_servers_metrics       |
| stats_proxysql_servers_status        |
+--------------------------------------+

mysql> SELECT  hostgroup_id, status, COUNT(*) FROM runtime_mysql_servers GROUP BY hostgroup_id, status;
ERROR 1045 (28000): ProxySQL Admin Error: no such table: runtime_mysql_servers

mysql> SELECT  hostgroup, status, COUNT(*) FROM stats_mysql_connection_pool GROUP BY hostgroup, status;
+-----------+---------+----------+
| hostgroup | status  | COUNT(*) |
+-----------+---------+----------+
| 10        | ONLINE  | 1        |
| 10        | SHUNNED | 4        |
| 20        | ONLINE  | 4        |
| 30        | ONLINE  | 4        |
+-----------+---------+----------+

NB: of course, the "new" query also works with an "admin" user, so no regression :)

So, this change should only improve the usability & security of this integration 👍

@aymeric-ledizes
Copy link
Contributor Author

Hello @hithwen, is this small PR ok to be merged ?

Copy link
Member

@FlorentClarret FlorentClarret left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi! Thanks for your contribution!

I left some comments. Basically, you can simply update the query and it should be fine.

proxysql/datadog_checks/proxysql/queries.py Show resolved Hide resolved
proxysql/tests/test_integration.py Show resolved Hide resolved
Copy link
Member

@FlorentClarret FlorentClarret left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

proxysql/datadog_checks/proxysql/queries.py Show resolved Hide resolved
@FlorentClarret FlorentClarret merged commit ea7854e into DataDog:master Jul 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants