varie

add-on/mysql-database-operator/README.md

@@ -0,0 +1,88 @@
+# MySQL Database Operator
+
+A small Kubernetes controller that provides a declarative `MySQLDatabase` CRD on top of an existing MySQL service, including Oracle MySQL Operator / InnoDB Cluster deployments.
+
+## Scope
+
+This MVP manages:
+
+- `CREATE DATABASE IF NOT EXISTS`
+- optional application user creation
+- application credentials Secret generation
+- database-scoped grants
+- `Retain` or `Delete` deletion policy
+- status/conditions
+
+It does **not** create or manage the MySQL/InnoDBCluster itself. The Oracle MySQL Operator remains responsible for the MySQL infrastructure.
+
+## Important production notes
+
+1. `adminSecretRef` must contain `username` and `password`.
+2. The controller currently connects to the host in `spec.connection.host`; if omitted it uses `spec.clusterRef.name`.
+3. The generated application Secret contains `username`, `password`, and `database`.
+4. The user is created as `'user'@'%'` because Kubernetes workloads normally connect over the cluster network. Tighten this later if your network model supports it.
+5. The controller intentionally supports a small allow-list of privileges; do not accept arbitrary SQL from the CRD.
+6. For production, add TLS support, NetworkPolicy, Secret rotation policy, metrics, admission validation, and tests before broad multi-team rollout.
+
+## Build
+
+```bash
+go mod tidy
+go build ./cmd
+
+docker build -t harbor.example.com/platform/mysql-database-operator:0.1.0 .
+docker push harbor.example.com/platform/mysql-database-operator:0.1.0
+```
+
+## Deploy on RKE2
+
+```bash
+kubectl create namespace mysql-database-operator-system
+kubectl apply -f config/crd/mysqldatabase-crd.yaml
+kubectl apply -f deploy/rbac.yaml
+sed 's#ghcr.io/example/mysql-database-operator:0.1.0#harbor.example.com/platform/mysql-database-operator:0.1.0#' deploy/deployment.yaml | kubectl apply -f -
+```
+
+Or Helm:
+
+```bash
+helm upgrade --install mysql-database-operator ./helm/mysql-database-operator \
+  --namespace mysql-database-operator-system \
+  --create-namespace \
+  --set image.repository=harbor.example.com/platform/mysql-database-operator \
+  --set image.tag=0.1.0
+```
+
+Then create the admin Secret and database:
+
+```bash
+kubectl create namespace team-a
+kubectl apply -f examples/admin-secret.yaml
+kubectl apply -f examples/mysql-database.yaml
+kubectl get mysqldatabase -n team-a
+kubectl describe mysqldatabase orders -n team-a
+kubectl get secret orders-db-credentials -n team-a
+```
+
+## Oracle MySQL Operator integration
+
+Example architecture:
+
+```text
+InnoDBCluster mysql-prod
+        |
+        | Service mysql-prod:3306
+        v
+MySQLDatabase orders
+        |
+        +-- CREATE DATABASE orders
+        +-- CREATE USER orders-app
+        +-- GRANT SELECT, INSERT, UPDATE, DELETE
+        +-- Secret orders-db-credentials
+```
+
+Use the actual Router/primary Service exposed by your Oracle MySQL Operator installation in `spec.connection.host` if it is not the same as `clusterRef.name`.
+
+## Verification
+
+The source tree was formatted with `gofmt`. Full `go test ./...` could not be executed in this environment because external Go module downloads are disabled; run `go mod tidy && go test ./...` in a network-enabled build environment before publishing the image.