Overview
The proxyro (Proxy Read Only) account is a read-only user in the sys tenant of an OceanBase Database cluster. It is a designated account for OBProxy to access OceanBase Database and has read-only privileges on all virtual tables and views in OceanBase Database. OBProxy provides high-performance load balancing capabilities. You can use the proxyro account to query tenant information such as the distribution of resource units and partition replicas (or log streams).
Procedure
The proxyro account is an exclusive account for OBProxy. For ease of management, when you use OCP to manage the OceanBase Database cluster, the system automatically creates a proxyro@sys account.
- For OceanBase Database versions earlier than V4.0, the proxyro@sys account is created with a default password.
- For OceanBase Database V4.0 and later versions, the proxyro@sys account is created with a random password.
The password for the proxyro account in the OceanBase Database cluster is written to the configuration of the associated OBProxy cluster. When you create an OBProxy cluster in the OCP console, the system provides different configuration policies based on the version of the OBProxy cluster.
- For OBProxy versions earlier than V4.0, when you create an OBProxy cluster in the OCP console, the system writes the default or custom password of the proxyro account to the global configuration of the OBProxy. The password of the proxyro account in the associated OceanBase Database cluster must be the same as this password.
- For OBProxy V4.0 and later versions, you can configure a different proxyro account password for each OceanBase Database cluster. Therefore, when you create an OBProxy V4.x cluster in the OCP console, you do not need to specify a global proxyro account password. Instead, when you associate an OceanBase Database cluster with the OBProxy cluster, the proxyro account password of the OceanBase Database cluster will be written to the configuration of the OBProxy cluster.
When managing OceanBase Database and OBProxy clusters in the OCP console, you do not need to be aware of the presence of the proxyro account unless you have special requirements for this account.
Create an OceanBase Database cluster
When you use OCP to create an OceanBase Database cluster, the system automatically creates a proxyro@sys account.
- For OceanBase Database versions earlier than V4.0, the proxyro@sys account is created with a default password.
- For OceanBase Database V4.0 and later versions, the proxyro@sys account is created with a random password.
Change the password of the proxyro account
You can change the password of the proxyro account for an OceanBase Database cluster in the following ways:
If the OceanBase Database cluster is not associated with an OBProxy cluster, you can directly change the password of the proxyro account in the sys tenant. For more information, see User management under a MySQL tenant.
Notice
For OceanBase Database cluster versions earlier than V4.0, changing the password of the proxyro account may cause a mismatch between the proxyro account password and the OBProxy global configuration. This mismatch may result in the inability to establish an association between the OceanBase Database cluster and the OBProxy cluster of a pre-V4.0 version.
If the OceanBase Database cluster is already associated with an OBProxy cluster, for OBProxy clusters of a pre-V4.0 version, you can change the global password of the proxyro account on the OBProxy cluster details page in the OCP console. For more information, see Change the password of the proxyro user.
Notice
Changing the password of the proxyro account in this manner is a high-risk operation. The relationship between the OBProxy cluster and the OceanBase Database cluster is a many-to-many (N-N) mapping, which may result in scenarios similar to the one depicted in the following figure.
As shown in this figure, note the following:
- If you change the proxyro account password for OBProxy cluster A, it will involve the following clusters: OBProxy cluster A, OBProxy cluster B, OBProxy cluster C, OceanBase Database cluster A, and OceanBase Database cluster B. You must change the proxyro account password for all the five clusters.
- You do not need to change the proxyro account password for OceanBase Database cluster C because the version of OBProxy cluster C is later than V4.0.0, which supports specifying a different proxyro account password for each OceanBase Database cluster. You only need to configure the new proxyro account password of OceanBase Database cluster B to the configuration of OBProxy cluster C.
Take over an OceanBase Database cluster
According to the description in the Change the password of the proxyro account section of this topic, you can change the password of the proxyro account in the OCP console. When an OceanBase Database cluster is taken over from one OCP to another, the proxyro account password of this OceanBase Database cluster must be recorded in the new OCP. There are two possible scenarios in this case:
If you already know the proxyro account password of the OceanBase Database cluster, you can choose to enter it in the text box Enter the password of the proxyro user on the Take over Cluster page. For more information, see Take over an OceanBase Database cluster. Then, OCP will use the password you entered to validate the proxyro account. If the validation is successful, it proceeds to the next step. If the validation fails, you will need to re-enter the correct password. If the OceanBase Database cluster does not have a proxyro account, OCP will create one with a default password or a random password, depending on the version of the OceanBase Database cluster.
If you do not know the proxyro account password of the OceanBase Database cluster, you can choose not to enter it in the text box Enter the password of the proxyro user. In this case, OCP will validate the proxyro account using the default password. If the validation is successful, it proceeds to the next step. If the validation fails, you must reset the password of the proxyro account by executing the following statement on the CLI, and then enter the correct password on the Take over Cluster page.
-- Log on as the root@sys user and then execute the following statement: ALTER USER proxyro IDENTIFIED BY 'xxxxx';
Create an OBProxy cluster
For OBProxy versions earlier than V4.0, when you create an OBProxy cluster in the OCP console, the system writes the default or custom password of the proxyro account to the global configuration of the OBProxy. The password of the proxyro account in the associated OceanBase Database cluster must be the same as this password.
For OBProxy V4.0 and later versions, you can configure a different proxyro account password for each OceanBase Database cluster. Therefore, when you create an OBProxy V4.x cluster in the OCP console, you do not need to specify a global proxyro account password. Instead, when you associate an OceanBase Database cluster with the OBProxy cluster, the proxyro account password of the OceanBase Database cluster will be written to the configuration of the OBProxy cluster.
For empty OBProxy clusters (clusters without deployed OBProxy Servers), OCP is unaware of the version to be deployed. To determine the version of the OBProxy cluster, an OBProxy Server needs to be added. For security purposes, an empty OBProxy cluster is considered to be an OBProxy cluster earlier than V4.0, and the system writes the default or custom password of the proxyro account to the global configuration of the OBProxy.