Skip to content

Commit a2379f7

Browse files
authored
(Bugfix) Grant privileges idempotency Fix
Prior to this commit, the Ubuntu 20.04 spec testing was failing two test cases at mysql_grant_spec. One of them was a simple mismatch between the expected stdout and actual stdout of the test case, and the other had to do with a misbehavior from the module at the time of granting privileges to users. The module upon retrieving the current privileges accounted only for the original static privileges and not the dynamic privileges added in newer mysql versions, causing an error in the code that is used to condense the array of privileges that make up `ALL` into a single statement. The code which condenses the returned privileges into a simple `ALL` has now been updated correctly trigger when dynamic privileges are in effect, avoiding this issue and ensuring idempotency.
1 parent bd7c4de commit a2379f7

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

lib/puppet/provider/mysql_grant/mysql.rb

+10
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,16 @@ def self.instances
6767
'RELOAD', 'REPLICATION CLIENT', 'REPLICATION SLAVE', 'SELECT', 'SHOW DATABASES', 'SHOW VIEW', 'SHUTDOWN', 'SUPER', 'TRIGGER',
6868
'UPDATE']
6969
sorted_privileges = ['ALL']
70+
71+
# Currently there is an issue with the behaviour of the module which was highlighted by the 'complex test' test case in 'mysql_grant_spec'. The module, upon retrieving all privileges from an
72+
# user, does not take into account that the latest version of mysql now includes dynamic privileges which are returned alongside the original static privileges and are set by 'ALL PRIVILEGES'
73+
# (shortened to 'ALL'). This is a workaround to remove the unnecesary privileges from the sorted_privileges list which is used to check for idempotency in test cases.
74+
elsif sorted_privileges == ['ALL', 'APPLICATION_PASSWORD_ADMIN', 'AUDIT_ABORT_EXEMPT', 'AUDIT_ADMIN', 'AUTHENTICATION_POLICY_ADMIN', 'BACKUP_ADMIN', 'BINLOG_ADMIN', 'BINLOG_ENCRYPTION_ADMIN',
75+
'CLONE_ADMIN', 'CONNECTION_ADMIN', 'ENCRYPTION_KEY_ADMIN', 'FLUSH_OPTIMIZER_COSTS', 'FLUSH_STATUS', 'FLUSH_TABLES', 'FLUSH_USER_RESOURCES',
76+
'GROUP_REPLICATION_ADMIN', 'GROUP_REPLICATION_STREAM', 'INNODB_REDO_LOG_ARCHIVE', 'INNODB_REDO_LOG_ENABLE', 'PASSWORDLESS_USER_ADMIN', 'PERSIST_RO_VARIABLES_ADMIN',
77+
'REPLICATION_APPLIER', 'REPLICATION_SLAVE_ADMIN', 'RESOURCE_GROUP_ADMIN', 'RESOURCE_GROUP_USER', 'ROLE_ADMIN', 'SERVICE_CONNECTION_ADMIN',
78+
'SESSION_VARIABLES_ADMIN', 'SET_USER_ID', 'SHOW_ROUTINE', 'SYSTEM_USER', 'SYSTEM_VARIABLES_ADMIN', 'TABLE_ENCRYPTION_ADMIN', 'XA_RECOVER_ADMIN']
79+
sorted_privileges = ['ALL']
7080
end
7181

7282
instance_configs[name] = {

spec/acceptance/types/mysql_grant_spec.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -464,7 +464,7 @@ class { 'mysql::server':
464464

465465
it 'finds the user #stdout' do
466466
run_shell('mysql -NBe "SHOW GRANTS FOR proxy1@tester"') do |r|
467-
expect(r.stdout).to match(%r{GRANT PROXY ON 'proxy_user'@'proxy_host' TO ['|`]proxy1['|`]@['|`]tester['|`]})
467+
expect(r.stdout).to match(%r{GRANT USAGE ON *.* TO ['|`]proxy1['|`]@['|`]tester['|`]\nGRANT PROXY ON ['|`]proxy_user['|`]@['|`]proxy_host['|`] TO ['|`]proxy1['|`]@['|`]tester['|`]\n})
468468
expect(r.stderr).to be_empty
469469
end
470470
end

0 commit comments

Comments
 (0)