Skip to main content
Feedback

Providing TLS setup

This page covers migration-specific TLS configuration only. For TLS modes, certificate requirements, and securing the MySQL server itself, refer to Securing Connections to an External MySQL 8 compliant database.

Step 1: Set the mode

Set the TLS mode in migrate_5x_to_6/scripts/migration-override.env — one file, used for both Kubernetes and Docker Swarm. Values are case-sensitive and hyphenated.

MYSQL_SERVICE_SSL_MODE="verify-ca"      # trust | verify-ca | verify-full
MYSQL_SERVICE_MUTUAL_TLS="disable"      # disable | enable

Step 2: Supply the PEM files

The PEM template files are located in templates/k8s/ (Kubernetes) or templates/swarm/ (Docker Swarm). Replace the placeholder content in each file, but do not rename the files.

PEM fileNeeded whenCreated by
mysql-service-ca.pemMYSQL_SERVICE_SSL_MODE is verify-ca or verify-fullDeploy script (ConfigMap / config)
mysql-service-client-cert.pemMYSQL_SERVICE_MUTUAL_TLS is enableDeploy script (ConfigMap / config)
mysql-service-client-key.pemMYSQL_SERVICE_MUTUAL_TLS is enableYou — create as a Secret before deploying
note

The deploy script does not create the client key Secret. Create it yourself before deploying, or the deployment fails.

# Kubernetes
kubectl create secret generic mysql-service-client-key \
  --from-file=templates/k8s/mysql-service-client-key.pem

# Docker Swarm (run on the manager node)
docker secret create migration-mysql-key templates/swarm/mysql-service-client-key.pem

Next steps: Customize migration configuration

Continue to Customizing migration configuration.

On this Page