Le 03/11/2026 à 10:19 PM, Alex Joseph a écrit :
MySQL 8.0 made caching_sha2_password the default authentication plugin and MySQL 8.4 disables mysql_native_password by default (it is removed in 9.0). None of the existing mysql-check modes works with a caching_sha2_password check user, and each of them generates an aborted connection on the server for every check:- pre-41 / post-41 do not set CLIENT_PLUGIN_AUTH, so the server rejects the handshake with error 1251 ("Client does not support authentication protocol requested by server") and the server is marked DOWN. - post-80 announces mysql_native_password, so the server answers with an AuthSwitchRequest (0xFE) to caching_sha2_password. The check accepts it as a valid reply since it is not an error packet, and reports the server UP. But the COM_QUIT pipelined after the handshake response is read by the server as the auth switch reply, and the handshake is aborted with error 1156 ("Got packets out of order"). In both cases the server counts a connection error for the HAProxy host (Aborted_connects, and the host cache handshake errors when skip_name_resolve is OFF, which is the MySQL default, and the HAProxy address resolves forward and backward). Once the host reaches max_connect_errors (100 by default), the server blocks it with ER_HOST_IS_BLOCKED (1129) and refuses every connection from it, including proxied client traffic, until FLUSH HOSTS is issued. With post-80 this happens while the check reported the server as healthy. This patch adds a "post-80-sha2" mode which sets CLIENT_PLUGIN_AUTH and announces caching_sha2_password with an empty auth response. For a password-less caching_sha2_password account the server authenticates in a single round trip and replies with an OK packet, then the pipelined COM_QUIT closes the session cleanly, so no connection error is recorded: CREATE USER 'haproxy'@'%' IDENTIFIED WITH caching_sha2_password BY ''; option mysql-check user haproxy post-80-sha2 Tested against MySQL 8.4.13 (skip_name_resolve=OFF, max_connect_errors=10) and Cloud SQL for MySQL 8.4.11 with a caching_sha2_password check user, one check every 2s: with post-80-sha2 the check is L7OK and neither Aborted_connects nor the host cache error counters move. With post-41 or post-80 every check adds one aborted connection and one host cache handshake error, and the HAProxy host is blocked (1129) after 10 checks, i.e. 20 seconds. The documentation and the mysql-check regtest are updated accordingly.
Thanks, now merged ! -- Christopher Faulet
