2

I have MySQL group replication with 3 servers. One of them experienced an error and was unable to recover its ONLINE status in the replication list due to an error connecting to a donor server.

[Repl] Slave I/O for channel 'group_replication_recovery': error connecting to master 'repl@PRIV_IP_HERE:3306' - retry-time: 60 retries: 1, Error_code: MY-002061

I re-initialized group replication on all 3 servers. Bootstrapping the replication list on the first server worked, but neither of the other 2 servers were able to join the group successfully (stuck in RECOVERING state).

How can I fix this group replication recovery process?

openyk
  • 65
  • 2
  • 9

1 Answers1

2

MY-002061 is an authentication error.

MySQL requires that any caching_sha2_password (auth type on your replication user) is protected by TLS or RSA.

https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html

To connect to the server using an account that authenticates with the caching_sha2_password plugin, you must use either a secure connection or an unencrypted connection that supports password exchange using an RSA key pair, as described later in this section.

If your network is secure, the most convenient way to solve this problem is to create a MYSQL RSA keypair:

mysql_ssl_rsa_setup

Then update your MYSQL config on each server to request the public key of the donor server during group replication recovery (instead of storing a local copy of the trusted public key which is a bit more work but prevents MITM attacks):

/etc/mysql/my.cnf

...
group_replication_recovery_get_public_key = 1
...

Then reload your MYSQL process and reattempt group replication:

sudo /etc/init.d/mysql reload

mysql> START GROUP_REPLICATION;

Worked for me, 2018-12-07.

Additional reference: https://www.digitalocean.com/community/tutorials/how-to-configure-mysql-group-replication-on-ubuntu-16-04

openyk
  • 65
  • 2
  • 9
  • Also see: https://dev.mysql.com/doc/refman/8.0/en/group-replication-options.html#sysvar_group_replication_recovery_get_public_key – openyk Dec 07 '18 at 15:09