Skip to content

Creating a MySQL data service#

This tutorial creates an Ametnes-managed MySQL database — a private data service you reach over an Ametnes network access endpoint. Both service/mysql:9.4 and service/mysql:8.0 encrypt client connections with TLS by default; only service/mysql:9.4 uses an Ametnes-CA certificate, so only there can clients verify the server identity (see the warning below).

Prerequisites#

  1. A service location (see Service Location).

Networking is automatic by default

Creating a network access resource is optional. If you do not create one, Ametnes manages network access for the location — a shared load balancer publishes the endpoints for the services deployed there — and the service attaches automatically. Create your own only if you want to control exposure (see Network Access Resources).

Create the MySQL service#

Select the kind (service/mysql:<version>), tier, storage and node count. Ametnes offers MySQL 9.4 and 8.0.

MySQL 8.0 TLS is encrypted but not verifiable

service/mysql:8.0 runs an older chart that has no managed certificate, so the control plane issues it none. mysqld 8.0.28+ then auto-generates a self-signed certificate and serves TLS anyway, so a default client (--ssl-mode=PREFERRED) still gets an encrypted session. That certificate is not signed by the Ametnes CA and does not match the service hostname, so --ssl-mode=VERIFY_CA and VERIFY_IDENTITY fail against 8.0. Use service/mysql:9.4 when you need a verifiable, Ametnes-CA-signed server certificate.

  1. Navigate to the Services left menu and click New Service.
  2. Enter Name: MysqlService.
  3. Select Kind: MySql 9.4 Service.
  4. Select the Location: your data service location. Leave Network unset to let Ametnes manage it.
  5. Select the Setup Architecture (for example Basic for evaluation, or Large and above for production).
  6. Set the Admin Password for the root user; a password is generated when omitted.
  7. Click Create Service and wait for the status ready.
service.tf
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
resource "ametnes_service" "mysql" {
  name     = "MysqlService"
  project  = ametnes_project.project.id
  location = data.ametnes_location.location.id
  kind     = "service/mysql:9.4"
  nodes    = 1
  capacity {
    storage = 10
  }
  config = {
    "architecture"   = "Basic"
    "admin.password" = "change-me"
  }
}

output "connections" {
  value = ametnes_service.mysql.connections
}

Connect#

Use the connections returned by the service (or the console's connection panel). MySQL listens on port 3306; the host is the service's DNS name on your zone. The admin user is root; the application user is ametnes (with database ametnes).

mysql -h <host> -P <port> -u root -p

A default mysql client negotiates TLS automatically: the server certificate is issued by the Ametnes CA, and only the CA certificate is distributed to the service (never the CA private key). Confirm the session is encrypted:

mysql> SHOW SESSION STATUS LIKE 'Ssl_cipher';
+---------------+------------------------+
| Variable_name | Value                  |
+---------------+------------------------+
| Ssl_cipher    | TLS_AES_128_GCM_SHA256 |
+---------------+------------------------+
1 row in set (0.00 sec)

An empty Ssl_cipher means the connection is not encrypted.

Notes#

  • On service/mysql:9.4 TLS is enabled by default and clients default to --ssl-mode=PREFERRED, so encryption is negotiated without extra flags. The server does not reject plaintext, so a client that explicitly disables TLS (--ssl-mode=DISABLED) still connects unencrypted. To require certificate verification, connect with --ssl-mode=VERIFY_CA and the published CA certificate.
  • MySQL 8.0 also encrypts by default, but with a self-signed, per-instance certificate that mysqld generates itself, so --ssl-mode=VERIFY_CA / VERIFY_IDENTITY fail there. See the warning above.

Next#