Thanks a bunch Christopher for the help.
Thanks Alex On Thu, Nov 5, 2026 at 1:01 PM Christopher Faulet <[email protected]> wrote: > Le 03/11/2026 à 10:19 PM, Alex Joseph a écrit : > > MySQL 8.0 made caching_sha2_password the default authentication plugin > > and MySQL 8.4 disables mysql_native_password by default (it is removed in > > 9.0). None of the existing mysql-check modes works with a > > caching_sha2_password check user, and each of them generates an aborted > > connection on the server for every check: > > > > - pre-41 / post-41 do not set CLIENT_PLUGIN_AUTH, so the server > rejects > > the handshake with error 1251 ("Client does not support > > authentication protocol requested by server") and the server is > > marked DOWN. > > > > - post-80 announces mysql_native_password, so the server answers with > > an AuthSwitchRequest (0xFE) to caching_sha2_password. The check > > accepts it as a valid reply since it is not an error packet, and > > reports the server UP. But the COM_QUIT pipelined after the > handshake > > response is read by the server as the auth switch reply, and the > > handshake is aborted with error 1156 ("Got packets out of order"). > > > > In both cases the server counts a connection error for the HAProxy host > > (Aborted_connects, and the host cache handshake errors when > > skip_name_resolve is OFF, which is the MySQL default, and the HAProxy > > address resolves forward and backward). Once the host reaches > max_connect_errors > > (100 by default), the server blocks it with ER_HOST_IS_BLOCKED (1129) > > and refuses every connection from it, including proxied client traffic, > > until FLUSH HOSTS is issued. With post-80 this happens while the check > > reported the server as healthy. > > > > This patch adds a "post-80-sha2" mode which sets CLIENT_PLUGIN_AUTH and > > announces caching_sha2_password with an empty auth response. For a > > password-less caching_sha2_password account the server authenticates in > > a single round trip and replies with an OK packet, then the pipelined > > COM_QUIT closes the session cleanly, so no connection error is recorded: > > > > CREATE USER 'haproxy'@'%' IDENTIFIED WITH caching_sha2_password BY > ''; > > option mysql-check user haproxy post-80-sha2 > > > > Tested against MySQL 8.4.13 (skip_name_resolve=OFF, > > max_connect_errors=10) and Cloud SQL for MySQL 8.4.11 with a > > caching_sha2_password check user, one check every 2s: with post-80-sha2 > > the check is L7OK and neither Aborted_connects nor the host cache error > > counters move. With post-41 or post-80 every check adds one aborted > > connection and one host cache handshake error, and the HAProxy host is > > blocked (1129) after 10 checks, i.e. 20 seconds. > > > > The documentation and the mysql-check regtest are updated accordingly. > > > Thanks, now merged ! > -- > Christopher Faulet > >
