Secure MySQL using Acme Protocol issued TLS certificates


KubeDB is the Kubernetes Native Database Management Solution which simplifies and automates routine database tasks such as Provisioning, Monitoring, Upgrading, Patching, Scaling, Volume Expansion, Backup, Recovery, Failure detection, and Repair for various popular databases on private and public clouds. The databases that KubeDB supports are MySQL, MongoDB, MariaDB, Elasticsearch, Redis, PostgreSQL, ProxySQL, Percona XtraDB, Memcached and PgBouncer. You can find the guides to all the supported databases here . In this tutorial we will show how to secure MySQL server using ACME Protocol issued TLS certificates with KubeDB. As we cannot use ACME Protocol issued TLS certificates directly to MysQL, we are going to use KubeDB provisioned ProxySQL server to secure the client connections with ACME protocol issued TLS certificates. We will cover the following steps:

  1. Install KubeDB
  2. Install cert-manager
  3. Deploy Sample MySQL Database
  4. Deploy ProxySQL with ACME Protocol issued TLS certificates
  5. Setup Ingress to expose ProxySQL
  6. Use MySQL database from Developer Workstation

Install KubeDB

We will follow the steps to install KubeDB.

Get Cluster ID

We need the cluster ID to get the KubeDB License. To get cluster ID we can run the following command:

$ kubectl get ns kube-system -o jsonpath='{.metadata.uid}'

Get License

Go to Appscode License Server to get the license.txt file. For this tutorial we will use KubeDB Enterprise Edition.

License Server

Install KubeDB

We will use helm to install KubeDB. Please install helm here if it is not already installed. Now, let’s install KubeDB.

$ helm repo add appscode
$ helm repo update

$ helm search repo appscode/kubedb
NAME                              	CHART VERSION	APP VERSION	DESCRIPTION                                       
appscode/kubedb                   	v2023.02.28  	v2023.02.28	KubeDB by AppsCode - Production ready databases...
appscode/kubedb-autoscaler        	v0.17.0      	v0.17.0    	KubeDB Autoscaler by AppsCode - Autoscale KubeD...
appscode/kubedb-catalog           	v2023.02.28  	v2023.02.28	KubeDB Catalog by AppsCode - Catalog for databa...
appscode/kubedb-community         	v0.24.2      	v0.24.2    	KubeDB Community by AppsCode - Community featur...
appscode/kubedb-crds              	v2023.02.28  	v2023.02.28	KubeDB Custom Resource Definitions                
appscode/kubedb-dashboard         	v0.8.0       	v0.8.0     	KubeDB Dashboard by AppsCode                      
appscode/kubedb-enterprise        	v0.11.2      	v0.11.2    	KubeDB Enterprise by AppsCode - Enterprise feat...
appscode/kubedb-grafana-dashboards	v2023.02.28  	v2023.02.28	A Helm chart for kubedb-grafana-dashboards by A...
appscode/kubedb-metrics           	v2023.02.28  	v2023.02.28	KubeDB State Metrics                              
appscode/kubedb-ops-manager       	v0.19.0      	v0.19.2    	KubeDB Ops Manager by AppsCode - Enterprise fea...
appscode/kubedb-opscenter         	v2023.02.28  	v2023.02.28	KubeDB Opscenter by AppsCode                      
appscode/kubedb-provisioner       	v0.32.0      	v0.32.1    	KubeDB Provisioner by AppsCode - Community feat...
appscode/kubedb-schema-manager    	v0.8.0       	v0.8.0     	KubeDB Schema Manager by AppsCode                 
appscode/kubedb-ui                	v2022.06.14  	0.3.26     	A Helm chart for Kubernetes                       
appscode/kubedb-ui-server         	v2021.12.21  	v2021.12.21	A Helm chart for kubedb-ui-server by AppsCode     
appscode/kubedb-webhook-server    	v0.8.0       	v0.8.0     	KubeDB Webhook Server by AppsCode  

# Install KubeDB Enterprise operator chart
$helm install kubedb appscode/kubedb \
  --version v2023.02.28 \
  --namespace kubedb --create-namespace \
  --set kubedb-provisioner.enabled=true \
  --set kubedb-ops-manager.enabled=true \
  --set kubedb-autoscaler.enabled=true \
  --set kubedb-dashboard.enabled=true \
  --set kubedb-schema-manager.enabled=true \
  --set-file global.license=/path/to/the/license.txt

Let’s verify the installation:

$ watch kubectl get pods --all-namespaces -l ""
NAMESPACE   NAME                                            READY   STATUS    RESTARTS        AGE
kubedb      kubedb-kubedb-autoscaler-5f54c44f78-jhf4p       1/1     Running   0               6m27s
kubedb      kubedb-kubedb-dashboard-7bbcdd5ff9-xqpxr        1/1     Running   0               6m27s
kubedb      kubedb-kubedb-ops-manager-f475b96db-rs6pf       1/1     Running   1               6m27s
kubedb      kubedb-kubedb-provisioner-7476c97f55-74sj4      1/1     Running   0               6m26s
kubedb      kubedb-kubedb-schema-manager-6f6db9f95f-q64q4   1/1     Running   0               6m27s
kubedb      kubedb-kubedb-webhook-server-99b6665b7-r4qd9    1/1     Running   0               6m27s

We can list the CRD Groups that have been registered by the operator by running the following command:

$ kubectl get crd -l
NAME                                              CREATED AT   2023-03-09T19:23:34Z      2023-03-09T19:25:39Z                        2023-03-09T19:24:52Z           2023-03-09T19:28:00Z          2023-03-09T19:21:07Z                                  2023-03-09T19:24:52Z                   2023-03-09T19:21:07Z                                 2023-03-09T19:24:57Z                  2023-03-09T19:21:07Z         2023-03-09T19:23:34Z                2023-03-09T19:26:43Z                 2023-03-09T19:28:16Z                               2023-03-09T19:24:52Z                2023-03-09T19:21:07Z                             2023-03-09T19:24:52Z              2023-03-09T19:21:07Z         2023-03-09T19:23:34Z                2023-03-09T19:26:40Z                 2023-03-09T19:28:04Z                               2023-03-09T19:24:53Z                2023-03-09T19:21:07Z           2023-03-09T19:23:34Z                  2023-03-09T19:26:40Z                   2023-03-09T19:28:12Z                                 2023-03-09T19:24:54Z                  2023-03-09T19:21:07Z   2023-03-09T19:23:34Z           2023-03-09T19:28:31Z                         2023-03-09T19:24:54Z          2023-03-09T19:21:07Z                             2023-03-09T19:24:54Z              2023-03-09T19:21:07Z        2023-03-09T19:23:34Z               2023-03-09T19:26:42Z                             2023-03-09T19:24:55Z                2023-03-09T19:28:24Z               2023-03-09T19:21:07Z        2023-03-09T19:23:35Z                2023-03-09T19:28:28Z                              2023-03-09T19:24:55Z               2023-03-09T19:21:07Z                    2023-03-09T19:28:42Z           2023-03-09T19:23:35Z                                2023-03-09T19:24:56Z                   2023-03-09T19:28:20Z   2023-03-09T19:23:35Z           2023-03-09T19:28:35Z                         2023-03-09T19:24:56Z                  2023-03-09T19:21:07Z                   2023-03-09T19:28:45Z

Deploy Sample MySQL Database

Now, we are going to Deploy MySQL using KubeDB. Let’s create a Namespace in which we will deploy the database.

$ kubectl create ns demo
namespace/demo created

Here is the yaml of the MySQL CRO we are going to use:

kind: MySQL
  name: mysql-server
  namespace: demo
    mode: GroupReplication
  replicas: 3
  version: "8.0.29"
  storageType: Durable
    storageClassName: linode-block-storage
    - ReadWriteOnce
        storage: 1Gi
  terminationPolicy: Wipeout

Let’s save this yaml configuration into mysql-server.yaml Then create the above MySQL CRO

$ kubectl create -f mysql-server.yaml created
  • In this yaml we can see in the spec.version field specifies the version of MySQL. Here, we are using MySQL version 8.0.29. You can list the KubeDB supported versions of MySQL by running $ kubectl get mysqlversions command.
  • specifies PVC spec that will be dynamically allocated to store data for this database. This storage spec will be passed to the StatefulSet created by KubeDB operator to run database pods. You can specify any StorageClass available in your cluster with appropriate resource requests.
  • And the spec.terminationPolicy field is Wipeout means that the database will be deleted without restrictions. It can also be “Halt”, “Delete” and “DoNotTerminate”. Learn More about these HERE .

Install cert-manager

Now, we are going to install cert-manager by the following command:

$ kubectl apply -f
namespace/cert-manager created created created created created created created
serviceaccount/cert-manager-cainjector created
serviceaccount/cert-manager created
serviceaccount/cert-manager-webhook created
configmap/cert-manager-webhook created created created created created created created created created created created created created created created created created created created created created created created created created created created created created
service/cert-manager created
service/cert-manager-webhook created
deployment.apps/cert-manager-cainjector created
deployment.apps/cert-manager created
deployment.apps/cert-manager-webhook created created created

Note: We are installing cert-manager version v1.10.1, you can specify your cert-manager version from HERE

Create an Issuer & Secret

Here, we are going to create an Issuer and Secret by using this yaml,

kind: Issuer
  name: bytebuilders-xyz
  namespace: demo
    # server:
    # Name of a secret used to store the ACME account private key
      name: bytebuilders-xyz-acme
    # ACME DNS-01 provider configurations
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
            name: bytebuilders-xyz-cloudflare
            key: api-token

apiVersion: v1
kind: Secret
  name: bytebuilders-xyz-cloudflare
  namespace: demo
type: Opaque
  api-token: "$CLOUDFLARE_API_TOKEN"

Let’s save this yaml configuration into issuer.yaml and apply it,

$ kubectl apply -f issuer.yaml created
secret/bytebuilders-xyz-cloudflare created

We will use this issuer to provision ProxySQL in the next step.

Deploy ProxySQL

Now, we are going to Deploy ProxySQL using KubeDB.

Here is the yaml of the ProxySQL

kind: ProxySQL
  name: proxy-server
  namespace: demo
  version: "2.4.4-debian"
  replicas: 1
  mode: GroupReplication
    name: mysql-server
  syncUsers: true
      kind: Issuer
      name: bytebuilders-xyz
    - alias: server
  terminationPolicy: Delete
    failureThreshold: 3

Let’s save this yaml configuration into proxy-server.yaml Then create the above ProxySQL CRO

$ kubectl create -f proxy-server.yaml created

Here in the .spec.backend section we need to mention the name of the backend appbinding. Let’s get the current backend appbinding that has been auto generated by KubeDB while deploying the MySQL :

$ kubectl get appbinding -n demo mysql-server -oyaml

kind: AppBinding
  annotations: |
      ... ... ...
  creationTimestamp: "2023-03-08T11:36:33Z"
  generation: 1
  labels: database mysql-server
  name: mysql-server
  namespace: demo
  - apiVersion:
    blockOwnerDeletion: true
    controller: true
    kind: MySQL
    name: mysql-server
    uid: 6af45c5b-4b17-44a4-a213-eb30eda2fb26
  resourceVersion: "22739"
  uid: 68f1d345-01c8-491c-8048-b25d7f5f7946
    kind: MySQL
    name: mysql-server
    namespace: demo
      name: mysql-server
      path: /
      port: 3306
      scheme: mysql
    url: tcp(mysql-server.demo.svc:3306)/
    kind: StashAddon
          name: mysql-backup-8.0.21
          - name: args
            value: --all-databases --set-gtid-purged=OFF
          name: mysql-restore-8.0.21
    name: mysql-server-auth
    name: mysql-server-client-cert
  version: 8.0.29

If you have external(not provisioned by KubeDB) MySQL, you may refer to this doc on what is appbinding and how to create one for MySQL.

Now, let’s check the certificate related objects that have been created in the cluster:

$ kubectl get certificaterequest,certificate,challenges,order -A
NAMESPACE   NAME                                                                          APPROVED   DENIED   READY   ISSUER               REQUESTOR                                         AGE
demo             True                True    bytebuilders-xyz   system:serviceaccount:cert-manager:cert-manager     2h

NAMESPACE   NAME                                                             READY   SECRET                               AGE
demo             True    proxy-server-server-cert             2h

NAMESPACE   NAME                                                                   STATE   AGE
demo   valid   2h

Setup Ingress to expose ProxySQL

Now, in this section we are going to setup ingress to expose our ProxySQL. We will use the same TLS certificate for the ingress that has been created for ProxySQL server.

kind: Ingress
  annotations: bytebuilders-xyz
  name: kubedb
  namespace: demo
  ingressClassName: nginx
  - host:
      - backend:
            name: proxy-server
              number: 6033
        path: /
        pathType: Prefix
  - hosts:
    secretName: proxy-server-server-cert

Let’s save this yaml configuration into ingress.yaml and apply it,

kubectl apply -f ingress.yaml created

Now, install Nginx ingress controller to set TCP port and expose the MySQL database:

helm repo add ingress-nginx
helm upgrade -i ingress-nginx ingress-nginx/ingress-nginx  \
  --namespace demo --create-namespace \
  --set tcp.6033="demo/proxy-server:6033"

Setup DNS using external-dns (optional)

Now, we are going to setum DNS by using external-dns:

provider: cloudflare
- ingress

- name: CF_API_TOKEN

policy: sync

logLevel: debug

registry: txt
txtOwnerId: ingress-kubedb

- --ignore-ingress-tls-spec

Let’s save this yaml configuration into external-dns.yaml

$ helm repo add external-dns
$ helm upgrade -i ingress-kubedb external-dns/external-dns \
  -n demo \
  -f external-dns.yaml

Once all of the above steps are handled correctly you will see that the following objects are created:

$ kubectl get all -n demo
NAME                                               READY   STATUS    RESTARTS   AGE
pod/ingress-kubedb-external-dns-6577b5687d-f577m   1/1     Running   0          2h
pod/ingress-nginx-controller-76cb758dcf-7jmc4      1/1     Running   0          2h
pod/mysql-server-0                             1/1     Running   0          2h
pod/mysql-server-1                             1/1     Running   0          2h
pod/mysql-server-2                             1/1     Running   0          2h
pod/proxy-server-0                             1/1     Running   0          2h

NAME                                         TYPE           CLUSTER-IP       EXTERNAL-IP    PORT(S)                                     AGE
service/ingress-kubedb-external-dns          ClusterIP   <none>         7979/TCP                                    2h
service/ingress-nginx-controller             LoadBalancer   80:30552/TCP,443:31346/TCP,6033:32105/TCP   2h
service/ingress-nginx-controller-admission   ClusterIP    <none>         443/TCP                                     2h
service/mysql-server                     ClusterIP    <none>         3306/TCP                                    2h
service/mysql-server-pods                ClusterIP      None             <none>         3306/TCP                                    2h
service/proxy-server                     ClusterIP    <none>         6033/TCP                                    2h
service/proxy-server-pods                ClusterIP      None             <none>         6033/TCP,6032/TCP                           2h

NAME                                          READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ingress-kubedb-external-dns   1/1     1            1           2h
deployment.apps/ingress-nginx-controller      1/1     1            1           2h

NAME                                                     DESIRED   CURRENT   READY   AGE
replicaset.apps/ingress-kubedb-external-dns-6577b5687d   1         1         1       2h
replicaset.apps/ingress-nginx-controller-76cb758dcf      1         1         1       2h

NAME                                READY   AGE
statefulset.apps/mysql-server       1/1     2h
statefulset.apps/proxy-server       1/1     2h

NAME                                                  TYPE               VERSION   AGE       8.0.29    2h

NAME                                VERSION   STATUS   AGE       8.0.29    Ready    2h

NAME                                VERSION        STATUS   AGE   2.4.4-debian    Ready    2h

Use MySQL database from Developer Workstation

Now, we will access the MySQL database through the ProxySQL server and create some sample data into it. To access the database through CLI, we have to get the credentials to access. We are going to use mysql-server-auth to get the credentials.

$ kubectl view-secret mysql-server-auth --all

Let’s insert some sample data into the MySQL database,

$ docker run -it mysql:8 bash
bash-4.4# mysql -h -uroot -p'aj.9sWpsqVNd798T' -P6033
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 13507
Server version: 8.0.29 MySQL Community Server - GPL

Copyright (c) 2000, 2022, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

| Database           |
| information_schema |
| kubedb_system      |
| mysql              |
| performance_schema |
| sys                |
5 rows in set (0.34 sec)

Query OK, 1 row affected (0.31 sec)

| Database           |
| Music              |
| information_schema |
| kubedb_system      |
| mysql              |
| performance_schema |
| sys                |
6 rows in set (0.27 sec)

Query OK, 0 rows affected, 1 warning (0.49 sec)

mysql> INSERT INTO Music.Artist (Name, Song) VALUES ("Bobby Bare", "500 Miles Away From Home");
Query OK, 1 row affected (0.30 sec)

mysql> SELECT * FROM Music.Artist;
| id | Name       | Song                     |
|  1 | Bobby Bare | 500 Miles Away From Home |
1 row in set (0.27 sec)

mysql> \s
mysql  Ver 8.0.32-0ubuntu0.22.04.2 for Linux on x86_64 ((Ubuntu))

Connection id:		15457
Current database:	information_schema
Current user:		root@
SSL:			    Cipher in use is TLS_AES_256_GCM_SHA384
Current pager:		stdout
Using outfile:		''
Using delimiter:	;
Server version:		8.0.27 (ProxySQL)
Protocol version:	10
Connection:		proxy-server.demo.svc via TCP/IP
Server characterset:	utf8mb4
Db     characterset:	utf8mb3
Client characterset:	latin1
Conn.  characterset:	latin1
TCP port:		6033
Binary data as:		Hexadecimal
Uptime:			21 hours 31 min 52 sec

Threads: 1  Questions: 7  Slow queries: 0

mysql> exit

From the above output we can see that the connection is working and it is TLS secured .

We have successfully accessed and use the MySQL database from developer side through the TLS secured ProxySQL and Nginx. More information about Run & Manage Production-Grade MySQL Database on Kubernetes can be found HERE . And for ProxySQL please refer to this doc .

We have made an in depth tutorial on Managing ACME protocol based certificates in ProxySQL and PgBouncer using KubeDB in Kubernetes. You can have a look into the video below:


To speak with us, please leave a message on our website .

To receive product announcements, follow us on Twitter .

To watch tutorials of various Production-Grade Kubernetes Tools Subscribe our YouTube channel.

More about MySQL in Kubernetes

If you have found a bug with KubeDB or want to request for new features, please file an issue .


Get Up and Running Quickly

Deploy, manage, upgrade Kubernetes on any cloud and automate deployment, scaling, and management of containerized applications.