Exposing MySQL

[arezvani]

How can I expose mysql with TCPIngress? I use this yaml:

apiVersion: configuration.konghq.com/v1beta1
kind: TCPIngress
metadata:
  name: mysql
  namespace: default
spec:
  rules:
  - backend:
      serviceName: my-mysql
      servicePort: 3306
    host: tls9443.kong.example
    port: 9443
  tls:
  - hosts:
    - tls9443.kong.example
    secretName: tls9443.kong.example

I can't connect to my mysql.

[bungle]

@arezvani, can you check if this is related to: https://github.com/Kong/kong/issues/10758

There is a workaround too.

[hbagdi]

cc @Kong/team-k8s

[arezvani]

@arezvani, can you check if this is related to: #10758

There is a workaround too.

@bungle It uses exposing with diffrent ports, I want expose with SNI type

[bungle]

@arezvani I meant about setting router_flavor=traditional as a workaround, can you test if it fixes your issue too? See: https://github.com/Kong/kong/issues/10758#issuecomment-1525457562

There seems to be an issue with router_flavor=traditional_compatible in 3.x series when stream routing. @arezvani I am just checking if that is the case with you as well.

@arezvani also, do you get any error message? Or any errors in logs?

[arezvani]

I use env KONG_ROUTER_FLAVOR=traditional. I get this error again:

[a.rezvani@master1 mysql]$ mysql -h tls9443.kong.example --port 30968
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0

[bungle]

@arezvani can you share your Kong KONG_STREAM_LISTEN configuration?

[arezvani]

@arezvani can you share your Kong KONG_STREAM_LISTEN configuration?

        - name: KONG_STREAM_LISTEN
          value: 0.0.0.0:9000, 0.0.0.0:9443 ssl

[bungle]

@arezvani, is that --port 30968 right, or should it be --port 9443?

[arezvani]

@arezvani, is that --port 30968 right, or should it be --port 9443?

I expose 9443 port with NodePort service on 30968 port that I can access from outside of cluster.

[fffonion]

Note 9443 is a TLS port, i think you would need the 9000 port for plain TCP without TLS termination. MySQL uses STARTTLS so even you are looking for a TLS termination at Kong side the TLS port won't work.

[arezvani]

@fffonion I will test that but I don't think it works because if I want use SNI, I should have tls.

[arezvani]

Note 9443 is a TLS port, i think you would need the 9000 port for plain TCP without TLS termination. MySQL uses STARTTLS so even you are looking for a TLS termination at Kong side the TLS port won't work.

9000 port is for exposing with port and for each user, you should use new port. I want to expose with different host so I should use expose with SNI and 9443 port.

[fffonion]

@arezvani Kong doesn't support terminating STARTTLS https://en.m.wikipedia.org/wiki/Opportunistic_TLS. On such request, Kong will not be able to decode SNI and thus your use case won't be supported. You can only treat it as a plain TCP request, or write plugins to support decoding this protocol.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.