最近有网友私信，在k8s部署的mysql集群设置了root密码后，所有节点的日志都报错 Access denied for user ‘root’@‘localhost’ (using password: NO)，于是我就模拟了一下，是这么个情况：

其实排查思路很清晰，Web UI 显示Readliness组件报错，日志也报错，日志报错是由于livenessProbe、xtrabackup组件。
就是这货进不了数据库报错，
最简单就是在statefulset.yaml文件把这两个组件删除，就是下面两货；在command中的xtrabackup、mysql命令参数上加上密码,，重新部署即可
缺点就是：无法知道数据库健康性，挂了也无人知道

解决方案是就给他们提供数据库密码就好了，然后进行伸缩3->0->3

livenessProbe:
  exec:
    command: ["mysqladmin", "ping","-p","root密码"]               !修改此处
  initialDelaySeconds: 30
  periodSeconds: 10
  timeoutSeconds: 5
readinessProbe:
  exec:
    command: ["mysql", "-h", "127.0.0.1", "-e", "SELECT 1","-p", "root密码"]   !修改此处

原因很简单，mysql -h 127.0.0.1 -e "select 1" -p '密码'，该命名在Linux终端执行会有一个warring：在命名行中使用密码，这个warring也是不允许的，所以仍然报错，现在需要解决的就是通过其他方式认证进入mysql即可。

解决方案： 使用configMap挂载配置文件进行认证
1.创建configMap配置文件

apiVersion: v1
kind: ConfigMap
metadata:
  name: mconfig
  labels:
    app: mconfig
data:
  passwd.cnf: |
    [mysql]
    user=root
    password=123456
    [mysqladmin]
    user=root
    password=123456

2.修改完的Mysql StatefulSet.yaml文件，红色为修改地方部署的时候把红色的删掉
[root@xxx ~]#kubectl edit statefulset mysql

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql
  serviceName: mysql
  replicas: 3
  template:
    metadata:
      labels:
        app: mysql
    spec:
      initContainers:
      - name: init-mysql
        image: mysql:5.7
        imagePullPolicy: IfNotPresent
        command:
        - bash
        - "-c"
        - |
          set -ex
          # Generate mysql server-id from pod ordinal index.
          [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
          ordinal=${BASH_REMATCH[1]}
          echo [mysqld] > /mnt/conf.d/server-id.cnf
          # Add an offset to avoid reserved server-id=0 value.
          echo server-id=$((100 + $ordinal)) >> /mnt/conf.d/server-id.cnf
          # Copy appropriate conf.d files from config-map to emptyDir.
          if [[ $ordinal -eq 0 ]]; then
            cp /mnt/config-map/master.cnf /mnt/conf.d/
          else
            cp /mnt/config-map/slave.cnf /mnt/conf.d/
          fi
        volumeMounts:
        - name: conf
          mountPath: /mnt/conf.d
        - name: config-map
          mountPath: /mnt/config-map
      - name: clone-mysql
        image: gcr.io/google-samples/xtrabackup:1.0
        imagePullPolicy: IfNotPresent
        command: !修改下面
        - bash
        - "-c"
        - |
          set -ex
          # Skip the clone if data already exists.
          [[ -d /var/lib/mysql/mysql ]] && exit 0
          # Skip the clone on master (ordinal index 0).
          [[ `hostname` =~ -([0-9]+)$ ]] || exit 1
          ordinal=${BASH_REMATCH[1]}
          [[ $ordinal -eq 0 ]] && exit 0
          # Clone data from previous peer.
          ncat --recv-only mysql-$(($ordinal-1)).mysql 3307 | xbstream -x -C /var/lib/mysql
          # Prepare the backup.
          xtrabackup --user=root --password=123456 --prepare --target-dir=/var/lib/mysql  
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
      containers:
      - name: mysql
        image: mysql:5.7
        imagePullPolicy: IfNotPresent
        env:
        - name: MYSQL_ROOT_PASSWORD
          value: "123456"
        ports:
        - name: mysql
          containerPort: 3306
        volumeMounts:
        - name: mconfig                          !挂载mconfig
          mountPath: /var/passwd.cnf
          subPath: var/passwd.cnf
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
        resources:
          requests:
            cpu: 50m
            memory: 50Mi
        livenessProbe:
          exec:
            command: ["mysqladmin", "--defaults-extra-file=/var/passwd.cnf", "ping"]  !修改此处
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
        readinessProbe:
          exec: !修改下面
            # Check we can execute queries over TCP (skip-networking is off). 
            command: ["mysql", "--defaults-extra-file=/var/passwd.cnf","-h", "127.0.0.1", "-e", "SELECT 1"]  
          initialDelaySeconds: 5
          periodSeconds: 2
          timeoutSeconds: 1
      - name: xtrabackup
        image: gcr.io/google-samples/xtrabackup:1.0
        imagePullPolicy: IfNotPresent
        ports:
        - name: xtrabackup
          containerPort: 3307
        command: !修改下面
        - bash
        - "-c"
        - |
          set -ex
          cd /var/lib/mysql
          # Determine binlog position of cloned data, if any.
          if [[ -f xtrabackup_slave_info ]]; then
            # XtraBackup already generated a partial "CHANGE MASTER TO" query
            # because we're cloning from an existing slave.
            mv xtrabackup_slave_info change_master_to.sql.in
            # Ignore xtrabackup_binlog_info in this case (it's useless).
            rm -f xtrabackup_binlog_info
          elif [[ -f xtrabackup_binlog_info ]]; then
            # We're cloning directly from master. Parse binlog position.
            [[ `cat xtrabackup_binlog_info` =~ ^(.*?)[[:space:]]+(.*?)$ ]] || exit 1
            rm xtrabackup_binlog_info
            echo "CHANGE MASTER TO MASTER_LOG_FILE='${BASH_REMATCH[1]}',\
                  MASTER_LOG_POS=${BASH_REMATCH[2]}" > change_master_to.sql.in
          fi
          # Check if we need to complete a clone by starting replication.
          if [[ -f change_master_to.sql.in ]]; then
            echo "Waiting for mysqld to be ready (accepting connections)"
            until mysql -h 127.0.0.1 -p123456 -e "SELECT 1"; do sleep 1; done
            echo "Initializing replication from clone position"
            # In case of container restart, attempt this at-most-once.
            mv change_master_to.sql.in change_master_to.sql.orig
            mysql -h 127.0.0.1 -p123456 <<EOF
          $(<change_master_to.sql.orig),
            MASTER_HOST='mysql-0.mysql',
            MASTER_USER='root',
            MASTER_PASSWORD='123456',
            MASTER_CONNECT_RETRY=10;
          START SLAVE;
          EOF
          fi
          # Start a server to send backups when requested by peers.
          exec ncat --listen --keep-open --send-only --max-conns=1 3307 -c \
            "xtrabackup --backup --slave-info --stream=xbstream --host=127.0.0.1 --password=123456 --user=root"
        volumeMounts:
        - name: data
          mountPath: /var/lib/mysql
          subPath: mysql
        - name: conf
          mountPath: /etc/mysql/conf.d
        resources:
          requests:
            cpu: 10m
            memory: 10Mi
      volumes:
      - name: mconfig          !添加mconfig卷
        configMap:
          name: mconfig
          items:
          - key: passwd.cnf
            path: var/passwd.cnf
      - name: conf
        emptyDir: {
    }
      - name: config-map
        configMap:
          name: mysql
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 0.1Gi

保存退出、重新伸缩即可，ヾ(￣▽￣)Bye_Bye

查看mysql-2容器日志信息

鸣谢以下文章提供参考信息
《Docker中查看mysql各环境参数》
《配置文件解除mysql报警》