diff --git a/pkg/server/datastore/sqlstore/mysql.go b/pkg/server/datastore/sqlstore/mysql.go index ca1d0ae8d6..8e626330f1 100644 --- a/pkg/server/datastore/sqlstore/mysql.go +++ b/pkg/server/datastore/sqlstore/mysql.go @@ -5,9 +5,11 @@ import ( "crypto/x509" "errors" "os" + "strings" "github.com/go-sql-driver/mysql" "github.com/jinzhu/gorm" + "github.com/sirupsen/logrus" "github.com/spiffe/spire/pkg/server/datastore/sqldriver/awsrds" // gorm mysql `cloudsql` dialect, for GCP @@ -18,7 +20,9 @@ import ( _ "github.com/jinzhu/gorm/dialects/mysql" ) -type mysqlDB struct{} +type mysqlDB struct { + logger logrus.FieldLogger +} const ( tlsConfigName = "spireCustomTLS" @@ -61,6 +65,10 @@ func (my mysqlDB) connect(cfg *configuration, isReadOnly bool) (db *gorm.DB, ver return nil, "", false, err } + if strings.HasPrefix(version, "5.7.") { + my.logger.Warn("MySQL 5.7 is no longer officially supported, and SPIRE does not guarantee compatibility with MySQL 5.7. Consider upgrading to a newer version of MySQL.") + } + supportsCTE, err = my.supportsCTE(db) if err != nil { return nil, "", false, err @@ -122,7 +130,6 @@ func configureConnection(cfg *configuration, isReadOnly bool) (*mysql.Config, er if len(cfg.RootCAPath) > 0 { rootCertPool := x509.NewCertPool() pem, err := os.ReadFile(cfg.RootCAPath) - if err != nil { return nil, errors.New("invalid mysql config: cannot find Root CA defined in root_ca_path") } diff --git a/pkg/server/datastore/sqlstore/sqlstore.go b/pkg/server/datastore/sqlstore/sqlstore.go index 9886e22f6c..f1645e7bd4 100644 --- a/pkg/server/datastore/sqlstore/sqlstore.go +++ b/pkg/server/datastore/sqlstore/sqlstore.go @@ -36,17 +36,19 @@ import ( "google.golang.org/protobuf/proto" ) -var sqlError = errs.Class("datastore-sql") -var validEntryIDChars = &unicode.RangeTable{ - R16: []unicode.Range16{ - {0x002d, 0x002e, 1}, // - | . - {0x0030, 0x0039, 1}, // [0-9] - {0x0041, 0x005a, 1}, // [A-Z] - {0x005f, 0x005f, 1}, // _ - {0x0061, 0x007a, 1}, // [a-z] - }, - LatinOffset: 5, -} +var ( + sqlError = errs.Class("datastore-sql") + validEntryIDChars = &unicode.RangeTable{ + R16: []unicode.Range16{ + {0x002d, 0x002e, 1}, // - | . + {0x0030, 0x0039, 1}, // [0-9] + {0x0041, 0x005a, 1}, // [A-Z] + {0x005f, 0x005f, 1}, // _ + {0x0061, 0x007a, 1}, // [a-z] + }, + LatinOffset: 5, + } +) const ( PluginName = "sql" @@ -508,7 +510,7 @@ func (ds *Plugin) FetchRegistrationEntry(ctx context.Context, // CountRegistrationEntries counts all registrations (pagination available) func (ds *Plugin) CountRegistrationEntries(ctx context.Context, req *datastore.CountRegistrationEntriesRequest) (count int32, err error) { - var actDb = ds.db + actDb := ds.db if req.DataConsistency == datastore.TolerateStale && ds.roDb != nil { actDb = ds.roDb } @@ -1034,7 +1036,9 @@ func (ds *Plugin) openDB(cfg *configuration, isReadOnly bool) (*gorm.DB, string, case isPostgresDbType(cfg.databaseTypeConfig.databaseType): dialect = postgresDB{} case isMySQLDbType(cfg.databaseTypeConfig.databaseType): - dialect = mysqlDB{} + dialect = mysqlDB{ + logger: ds.log, + } default: return nil, "", false, nil, sqlError.New("unsupported database_type: %v", cfg.databaseTypeConfig.databaseType) } @@ -2926,7 +2930,7 @@ func buildListRegistrationEntriesQuery(dbType string, supportsCTE bool, req *dat func buildListRegistrationEntriesQuerySQLite3(req *datastore.ListRegistrationEntriesRequest) (string, []any, error) { builder := new(strings.Builder) filtered, args, err := appendListRegistrationEntriesFilterQuery("\nWITH listing AS (\n", builder, SQLite, req) - var downstream = false + downstream := false if req.ByDownstream != nil { downstream = *req.ByDownstream } @@ -3021,7 +3025,7 @@ func buildListRegistrationEntriesQueryPostgreSQL(req *datastore.ListRegistration builder := new(strings.Builder) filtered, args, err := appendListRegistrationEntriesFilterQuery("\nWITH listing AS (\n", builder, PostgreSQL, req) - var downstream = false + downstream := false if req.ByDownstream != nil { downstream = *req.ByDownstream } @@ -3160,7 +3164,7 @@ LEFT JOIN `) filtered, args, err := appendListRegistrationEntriesFilterQuery("WHERE E.id IN (\n", builder, MySQL, req) - var downstream = false + downstream := false if req.ByDownstream != nil { downstream = *req.ByDownstream } @@ -3188,7 +3192,7 @@ func buildListRegistrationEntriesQueryMySQLCTE(req *datastore.ListRegistrationEn builder := new(strings.Builder) filtered, args, err := appendListRegistrationEntriesFilterQuery("\nWITH listing AS (\n", builder, MySQL, req) - var downstream = false + downstream := false if req.ByDownstream != nil { downstream = *req.ByDownstream } @@ -3301,7 +3305,6 @@ func countRegistrationEntries(ctx context.Context, db *sqlDB, _ logrus.FieldLogg for { resp, err := listRegistrationEntriesOnce(ctx, db.raw, db.databaseType, db.supportsCTE, listReq) - if err != nil { return -1, err } diff --git a/test/integration/suites/datastore-mysql-replication/01-test-variants b/test/integration/suites/datastore-mysql-replication/01-test-variants index fd4b4063e6..a09d2f7195 100755 --- a/test/integration/suites/datastore-mysql-replication/01-test-variants +++ b/test/integration/suites/datastore-mysql-replication/01-test-variants @@ -68,7 +68,7 @@ get_mysql_root_password() { echo "${root_password}" } -# Setup a primary server with group replication. It is compatible with MySQL 5.7 and above. +# Setup a primary server with group replication. configure-readwrite-group-replication() { service=$1 mysql_root_password=$2 @@ -86,7 +86,7 @@ SELECT * FROM performance_schema.replication_group_members; docker compose exec -T "${service}" mysql -uroot "-p$mysql_root_password" -e "${replication_script}" } -# Setup a replica server with group replication. It is compatible with MySQL 5.7 and above. +# Setup a replica server with group replication. configure-readonly-group-replication() { service=$1 mysql_root_password=$2 @@ -118,11 +118,4 @@ test-mysql-replication() { docker-stop "${readwrite_service_name}" "${readonly_service_name}" } -arch=$(uname -m) -if [ $arch = "amd64" ] || [ $arch = "x86_64" ]; then - test-mysql-replication mysql-5-7 || exit 1 -else - log-warn "skipping MySQL 5.7 test on $arch" -fi - test-mysql-replication mysql-8-0 || exit 1 diff --git a/test/integration/suites/datastore-mysql-replication/docker-compose.yaml b/test/integration/suites/datastore-mysql-replication/docker-compose.yaml index a4e1bd3429..1ce8f09d49 100644 --- a/test/integration/suites/datastore-mysql-replication/docker-compose.yaml +++ b/test/integration/suites/datastore-mysql-replication/docker-compose.yaml @@ -1,65 +1,5 @@ version: '3.5' services: - # MySQL 5.7 containers - mysql-5-7-readwrite: - image: mysql/mysql-server:5.7 - environment: - - MYSQL_PASSWORD=test - - MYSQL_DATABASE=spire - - MYSQL_USER=spire - - MYSQL_RANDOM_ROOT_PASSWORD=yes - ports: - - "9999:3306" - container_name: mysql-5-7-readwrite - command: - - "--server-id=1" - - "--log-bin=mysql-bin-1.log" - - "--enforce-gtid-consistency=ON" - - "--log-slave-updates=ON" - - "--gtid-mode=ON" - - "--transaction-write-set-extraction=XXHASH64" - - "--binlog-checksum=NONE" - - "--master-info-repository=TABLE" - - "--relay-log-info-repository=TABLE" - - "--plugin-load=group_replication.so" - - "--relay-log-recovery=ON" - - "--group-replication-start-on-boot=OFF" - - "--group-replication-group-name=43991639-43EE-454C-82BD-F08A13F3C3ED" - - "--group-replication-local-address=mysql-5-7-readwrite:33061" - - "--group-replication-group-seeds=mysql-5-7-readwrite:33061,mysql-5-7-readonly:33062" - - "--group-replication-single-primary-mode=ON" - - "--group-replication-enforce-update-everywhere-checks=OFF" - - "--group-replication-auto-increment-increment=1" - mysql-5-7-readonly: - image: mysql/mysql-server:5.7 - environment: - - MYSQL_PASSWORD=test - - MYSQL_DATABASE=spire - - MYSQL_USER=spire - - MYSQL_RANDOM_ROOT_PASSWORD=yes - ports: - - "10000:3306" - container_name: mysql-5-7-readonly - command: - - "--server-id=2" - - "--log-bin=mysql-bin-1.log" - - "--enforce-gtid-consistency=ON" - - "--log-slave-updates=ON" - - "--gtid-mode=ON" - - "--transaction-write-set-extraction=XXHASH64" - - "--binlog-checksum=NONE" - - "--master-info-repository=TABLE" - - "--relay-log-info-repository=TABLE" - - "--plugin-load=group_replication.so" - - "--relay-log-recovery=ON" - - "--group-replication-start-on-boot=OFF" - - "--group-replication-group-name=43991639-43EE-454C-82BD-F08A13F3C3ED" - - "--group-replication-local-address=mysql-5-7-readonly:33062" - - "--group-replication-group-seeds=mysql-5-7-readwrite:33061,mysql-5-7-readonly:33062" - - "--group-replication-single-primary-mode=ON" - - "--group-replication-enforce-update-everywhere-checks=OFF" - - "--group-replication-auto-increment-increment=1" - # MySQL 8.0 containers mysql-8-0-readwrite: image: mysql/mysql-server:8.0 diff --git a/test/integration/suites/datastore-mysql/01-test-variants b/test/integration/suites/datastore-mysql/01-test-variants index 3d14095681..681c50451f 100755 --- a/test/integration/suites/datastore-mysql/01-test-variants +++ b/test/integration/suites/datastore-mysql/01-test-variants @@ -51,11 +51,4 @@ test-mysql() { docker-stop "${SERVICE}" } -arch=$(uname -m) -if [ $arch = "amd64" ] || [ $arch = "x86_64" ]; then - test-mysql mysql-5-7 || exit 1 -else - log-warn "skipping MySQL 5.7 test on $arch" -fi - test-mysql mysql-8-0 || exit 1 diff --git a/test/integration/suites/datastore-mysql/README.md b/test/integration/suites/datastore-mysql/README.md index 17f8b997e1..8edb888d50 100644 --- a/test/integration/suites/datastore-mysql/README.md +++ b/test/integration/suites/datastore-mysql/README.md @@ -4,7 +4,6 @@ The suite runs the following MySQL versions against the SQL datastore unit tests: -- 5.7 - 8.0 A special unit test binary is built from sources that targets the docker diff --git a/test/integration/suites/datastore-mysql/docker-compose.yaml b/test/integration/suites/datastore-mysql/docker-compose.yaml index 98ff40192a..847acc25ac 100644 --- a/test/integration/suites/datastore-mysql/docker-compose.yaml +++ b/test/integration/suites/datastore-mysql/docker-compose.yaml @@ -1,15 +1,4 @@ services: - mysql-5-7: - image: mysql:5.7 - environment: - - MYSQL_PASSWORD=test - - MYSQL_DATABASE=spire - - MYSQL_USER=spire - - MYSQL_RANDOM_ROOT_PASSWORD=yes - tmpfs: - - /var/lib/mysql - ports: - - "9999:3306" mysql-8-0: image: mysql:8.0 environment: