mariadb-isalive container stuck with "ERROR 1045 (28000): Access denied for user..."

[nextcloud]

mariadb-isalive container stuck with "ERROR 1045 (28000): Access denied for user..."

[hubwoop]

Could we use this as a solution?

{{- if .Values.mariadb.enabled }}
initContainers:
- name: mariadb-isalive
  image: bitnami/mariadb
  env:
    - name: MYSQL_USER
      valueFrom:
        secretKeyRef:
          name: {{ .Values.externalDatabase.existingSecret.secretName | default (printf "%s-%s" .Release.Name "db") }}
          key: {{ .Values.externalDatabase.existingSecret.usernameKey | default "db-username" }}
    - name: MYSQL_PASSWORD
      valueFrom:
        secretKeyRef:
          name: {{ .Values.externalDatabase.existingSecret.secretName | default (printf "%s-%s" .Release.Name "db") }}
          key: {{ .Values.externalDatabase.existingSecret.passwordKey | default "db-password" }}
  command:
    - "sh"
    - "-c"
    - {{ printf "until mysql --host=%s-mariadb --user=${MYSQL_USER} --password=${MYSQL_PASSWORD} --execute=\"SELECT 1;\"; do echo waiting for mysql; sleep 2; done;" .Release.Name }}
{{- end }}

[tvories]

OK, I think I see the issue here. 2.5.5 adds a test to validate that MySQL is up before the nextcloud pod starts. It appears that using an existing secret must not interpolate the value mariadb.db.password to the helm chart values.

I'm not familiar enough with how exactly helm populates that value to the initContainers if the value is an existing secret.

I could add a check to the helm template to only run that if the password is defined, but maybe there's a way to incorporate both features.

[tvories]

I will write up a conditional for the maria.db.password check just to have a solution, but it would be nice to look into what's possible.

[tvories]

Can you provide some of your values (removing sensitive data)?

[hubwoop]

Sure, here you go, thanks for taking the time:

image:
  tag: 21-beta

nextcloud:
  host: nextcloud.mydomain.internet
  existingSecret:
    enabled: true
    secretName: nextcloud-helm-chart
    usernameKey: nextcloud-username
    passwordKey: nextcloud-password
  phpConfigs: {}
  defaultConfigs:
    .htaccess: true
    redis.config.php: true
    apache-pretty-urls.config.php: true
    apcu.config.php: true
    apps.config.php: true
    autoconfig.php: true
    smtp.config.php: true
  configs:
    https.config.php: |-
      <?php
      $CONFIG = array (
        'overwriteprotocol' => 'https',
      );
  strategy:
    type: Recreate
  extraEnv:
  extraVolumes:
  extraVolumeMounts:
internalDatabase:
  enabled: false
externalDatabase:
  enabled: true
  type: mysql
  database: nextcloud
  existingSecret:
    enabled: true
    secretName: nextcloud-database
    usernameKey: mariadb-username
    passwordKey: mariadb-password
mariadb:
  enabled: true
  existingSecret: nextcloud-database
  db:
    name: nextcloud
    user: nextcloud
  master:
    persistence:
      enabled: true
persistence:
  enabled: true
  annotations: {}
  size: 200Gi
metrics:
  enabled: true
  https: true
  service:
    annotations: {}
    labels:
      app: nextcloud-metrics

[tvories]

Just to clarify, this was working on release 2.5.4 (or earlier)?

[hubwoop]

Yep, we've set the version to 2.5.* in argo-cd so it went to 2.5.5 from 2.5.4 just after the latest release

[hubwoop]

Yep, looks like the root cause, I will also look for a solution.

[tvories]

@hubwoop that's a great solution! Would you want to submit a PR for that? I can take care of it later if you can't for some reason.

[hubwoop]

Cool! Sure, I'll open a PR later today (GMT).

[markusschuettler]

Hi,
any progress on this?

[mariusziemke]

Hey guys, templating the Release.Name (--host=%s-mariadb) inside the initContainer is creating trouble for external databases which use another url.

Maybe use _helpers.tpl to check wether the externalDatabase is set and use its url instead.

EDIT: Only applies if you still use the .Values.mariadb.enabled option, but e.g. change its fullNameOverride option or you want to use a specific pod of the StatefulSet.