italiadatacenter/add-on/mysql-database-operator

MySQL Database Operator

A small Kubernetes controller that provides a declarative MySQLDatabase CRD on top of an existing MySQL service, including Oracle MySQL Operator / InnoDB Cluster deployments.

Scope

This MVP manages:

• CREATE DATABASE IF NOT EXISTS
• optional application user creation
• application credentials Secret generation
• database-scoped grants
• Retain or Delete deletion policy
• status/conditions

It does not create or manage the MySQL/InnoDBCluster itself. The Oracle MySQL Operator remains responsible for the MySQL infrastructure.

Important production notes

1. adminSecretRef must contain username and password.
2. The controller currently connects to the host in spec.connection.host; if omitted it uses spec.clusterRef.name.
3. The generated application Secret contains username, password, and database.
4. The user is created as 'user'@'%' because Kubernetes workloads normally connect over the cluster network. Tighten this later if your network model supports it.
5. The controller intentionally supports a small allow-list of privileges; do not accept arbitrary SQL from the CRD.
6. For production, add TLS support, NetworkPolicy, Secret rotation policy, metrics, admission validation, and tests before broad multi-team rollout.

Build

go mod tidy
go build ./cmd

docker build -t harbor.example.com/platform/mysql-database-operator:0.1.0 .
docker push harbor.example.com/platform/mysql-database-operator:0.1.0

Deploy on RKE2

kubectl create namespace mysql-database-operator-system
kubectl apply -f config/crd/mysqldatabase-crd.yaml
kubectl apply -f deploy/rbac.yaml
sed 's#ghcr.io/example/mysql-database-operator:0.1.0#harbor.example.com/platform/mysql-database-operator:0.1.0#' deploy/deployment.yaml | kubectl apply -f -

Or Helm:

helm upgrade --install mysql-database-operator ./helm/mysql-database-operator \
  --namespace mysql-database-operator-system \
  --create-namespace \
  --set image.repository=harbor.example.com/platform/mysql-database-operator \
  --set image.tag=0.1.0

Then create the admin Secret and database:

kubectl create namespace team-a
kubectl apply -f examples/admin-secret.yaml
kubectl apply -f examples/mysql-database.yaml
kubectl get mysqldatabase -n team-a
kubectl describe mysqldatabase orders -n team-a
kubectl get secret orders-db-credentials -n team-a

Oracle MySQL Operator integration

Example architecture:

InnoDBCluster mysql-prod
        |
        | Service mysql-prod:3306
        v
MySQLDatabase orders
        |
        +-- CREATE DATABASE orders
        +-- CREATE USER orders-app
        +-- GRANT SELECT, INSERT, UPDATE, DELETE
        +-- Secret orders-db-credentials

Use the actual Router/primary Service exposed by your Oracle MySQL Operator installation in spec.connection.host if it is not the same as clusterRef.name.

Verification

The source tree was formatted with gofmt. Full go test ./... could not be executed in this environment because external Go module downloads are disabled; run go mod tidy && go test ./... in a network-enabled build environment before publishing the image.