Kubernetes中Spring Cloud微服务MySQL用户权限拒绝问题修复

问题现象 #

执行kubectl apply -f k8s部署Spring Boot微服务后，订单服务、支付服务、认证服务及产品服务均抛出以下数据库权限错误：

Caused by: java.sql.SQLException: Access denied for user 'springmicroserviceuser'@'172.17.0.6' (using password: YES)

问题根源 #

当前MySQL初始化脚本（ConfigMap中的init.sql）仅创建了仅允许本地访问的用户springmicroserviceuser'@'localhost，但Kubernetes集群内的微服务是通过集群内部IP（如错误中的172.17.0.6）连接MySQL，该用户权限不允许远程访问。

解决方案 #

修改MySQL初始化脚本，创建允许所有主机访问的数据库用户，并确保权限配置正确。以下是修正后的完整MySQL部署YAML：

# Persistent Volume
apiVersion: v1
kind: PersistentVolume
metadata:
  name: mysql-pv
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteOnce
  storageClassName: manual
  hostPath:
    #    path: "/mnt/data"  # - for Unix/Linux
    path: "/run/desktop/mnt/host/c/temp/testfiles"
    type: DirectoryOrCreate
---

# Persistent Volume Claim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
spec:
  resources:
    requests:
      storage: 1Gi
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
---

# StatefulSet - MySql
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql
  serviceName: mysql
  replicas: 1
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - name: mysql
          image: mysql:8.0
          env:
            - name: MYSQL_ROOT_PASSWORD
              value: ippavlova_1990
          ports:
            - containerPort: 3306
              name: mysql
          volumeMounts:
            - name: mysql-initdb
              mountPath: /docker-entrypoint-initdb.d
            - name: mysql-persistent-storage
              mountPath: /var/lib/mysql
      volumes:
        - name: mysql-initdb
          configMap:
            name: mysql-initdb-cm
        - name: mysql-persistent-storage
          persistentVolumeClaim:
            claimName: mysql-pvc
---

# Headless Service
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  clusterIP: None
  selector:
    app: mysql
  ports:
    - port: 3306
---

# ConfigMap - MySQL初始化脚本
apiVersion: v1
kind: ConfigMap
metadata:
  name: mysql-initdb-cm
data:
  init.sql: |
    CREATE USER 'springmicroserviceuser'@'%' IDENTIFIED BY '111111';
    CREATE DATABASE IF NOT EXISTS orderdb;
    CREATE DATABASE IF NOT EXISTS paymentdb;
    CREATE DATABASE IF NOT EXISTS productdb;
    GRANT ALL PRIVILEGES ON `orderdb`.* TO 'springmicroserviceuser'@'%' WITH GRANT OPTION;
    GRANT ALL PRIVILEGES ON `paymentdb`.* TO 'springmicroserviceuser'@'%' WITH GRANT OPTION;
    GRANT ALL PRIVILEGES ON `productdb`.* TO 'springmicroserviceuser'@'%' WITH GRANT OPTION;
    FLUSH PRIVILEGES;

关键修改点 #

1. 创建允许远程访问的用户：将CREATE USER 'springmicroserviceuser'@'localhost'改为CREATE USER 'springmicroserviceuser'@'%'，其中%表示允许从任何主机访问。
2. 修正脚本格式：原脚本中密码行存在不必要的换行，已修正为连续语句。
3. 添加权限刷新：新增FLUSH PRIVILEGES;确保权限立即生效。

操作步骤 #

1. 删除原有MySQL相关资源：

kubectl delete -f k8s/mysql.yaml # 替换为你的MySQL配置文件路径

2. 应用修正后的配置：

kubectl apply -f k8s/mysql.yaml

3. 重新部署各微服务：

kubectl apply -f k8s/ # 重新部署所有服务

内容的提问来源于stack exchange，提问作者Sercan Noyan Germiyanoğlu