Mysql主从复制部署过程解读

# 检查 MySQL 版本
mysql -V

[mysqld]
server-id = 1                 # 唯一标识，建议使用IP地址的最后一个数
log-bin = mysql-bin           # 启用二进制日志
gtid_mode = ON
enforce_gtid_consistency = ON
log_slave_updates = ON
binlog_format = ROW

sudo systemctl restart mysql
mysql -e "SHOW VARIABLES LIKE 'gtid_mode';"  # 应显示 ON
mysql -e "SHOW VARIABLES LIKE 'enforce_gtid_consistency';"  # 应显示 ON

CREATE USER 'repl_user'@'%' IDENTIFIED BY 'password';
GRANT REPLICATION SLAVE ON *.* TO 'repl_user'@'%';
FLUSH PRIVILEGES;

[mysqld]
server-id = 2                 # 唯一标识，不能与主库重复
log-bin = mysql-bin           # 启用二进制日志
read-only = 1                 # 从库设置为只读（可选）
gtid_mode = ON
enforce_gtid_consistency = ON
log_slave_updates = ON
binlog_format = ROW

sudo systemctl restart mysql

在从服务器上执行以下命令，配置主从关系：
CHANGE MASTER TO
MASTER_HOST='主服务器IP',
MASTER_USER='repl_user',
MASTER_PASSWORD='password',
MASTER_AUTO_POSITION = 1;  # 使用 GTID 自动定位

START SLAVE;

SHOW SLAVE STATUS\G;    #检查 IO 和 SQL 线程状态，确认从服务器是否落后于主服务器
检查以下两个状态是否均为 Yes：
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Seconds_Behind_Master: 0

# step 1 在主库和从库生成 SSL 证书
# 在主库和从库分别执行（使用相同的 CA）
mkdir /etc/mysql/ssl && cd /etc/mysql/ssl
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca.pem
openssl req -newkey rsa:2048 -days 3650 -nodes -keyout server-key.pem -out server-csr.pem
openssl x509 -req -in server-csr.pem -days 3650 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

# step 2 配置主库 my.cnf
[mysqld]
ssl-ca=/etc/mysql/ssl/ca.pem
ssl-cert=/etc/mysql/ssl/server-cert.pem
ssl-key=/etc/mysql/ssl/server-key.pem

# step 3 配置从库 my.cnf
[mysqld]
ssl-ca=/etc/mysql/ssl/ca.pem
ssl-cert=/etc/mysql/ssl/server-cert.pem
ssl-key=/etc/mysql/ssl/server-key.pem

# step 4 重启主从库服务
systemctl restart mysql

# step 5 创建用户
# 创建使用旧认证方式的复制用户
-- 在主库执行
CREATE USER 'repl_user'@'%' IDENTIFIED WITH mysql_native_password BY 'password';
GRANT REPLICATION SLAVE ON *.* TO 'repl_user'@'%';
FLUSH PRIVILEGES;

# 修改 MySQL 用户认证方式
ALTER USER 'yang'@'%' IDENTIFIED WITH mysql_native_password BY 'your_password';
FLUSH PRIVILEGES;

[mysqld]
require_secure_transport = OFF  # 关闭强制 SSL

-- 从库执行
CHANGE MASTER TO
  MASTER_HOST='主库IP',
  MASTER_USER='repl_user',
  MASTER_PASSWORD='password',
  MASTER_PORT=3306,
  MASTER_LOG_FILE='主库binlog文件',
  MASTER_LOG_POS=主库binlog位置;
START SLAVE;

stop slave;        #停止复制从库
reset slave;        #删除从库配置
reset master;        #删除主库配置
SHOW MASTER STATUS;    #查询当前主库的 binlog 文件和位置