MySQL 8.0: Grant required privileges to xtrabackup user

Author: jan-win1993

manifests/backup/xtrabackup.pp

@@ -48,25 +48,60 @@
       password_hash => mysql::password($backuppassword),
       require       => Class['mysql::server::root_password'],
     }
-
-    if $::osfamily == 'debian' and $::operatingsystemmajrelease == '11' {
-      mysql_grant { "${backupuser}@localhost/*.*":
+    if versioncmp($facts['mysql_version'], '8') >= 0 {
+      if $::osfamily == 'debian' and $::operatingsystemmajrelease == '11' {
+        mysql_grant { "${backupuser}@localhost/*.*":
+          ensure     => $ensure,
+          user       => "${backupuser}@localhost",
+          table      => '*.*',
+          privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES', 'BACKUP_ADMIN'],
+          require    => Mysql_user["${backupuser}@localhost"],
+        }
+      }
+      else {
+        mysql_grant { "${backupuser}@localhost/*.*":
+          ensure     => $ensure,
+          user       => "${backupuser}@localhost",
+          table      => '*.*',
+          privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT', 'BACKUP_ADMIN'],
+          require    => Mysql_user["${backupuser}@localhost"],
+        }
+      }
+      mysql_grant { "${backupuser}@localhost/performance_schema.keyring_component_status":
         ensure     => $ensure,
         user       => "${backupuser}@localhost",
-        table      => '*.*',
-        privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES'],
+        table      => 'performance_schema.keyring_component_status',
+        privileges => ['SELECT'],
         require    => Mysql_user["${backupuser}@localhost"],
       }
-    }
-    else {
-      mysql_grant { "${backupuser}@localhost/*.*":
+      mysql_grant { "${backupuser}@localhost/performance_schema.log_status":
         ensure     => $ensure,
         user       => "${backupuser}@localhost",
-        table      => '*.*',
-        privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT'],
+        table      => 'performance_schema.log_status',
+        privileges => ['SELECT'],
         require    => Mysql_user["${backupuser}@localhost"],
       }
     }
+    else {
+      if $::osfamily == 'debian' and $::operatingsystemmajrelease == '11' {
+        mysql_grant { "${backupuser}@localhost/*.*":
+          ensure     => $ensure,
+          user       => "${backupuser}@localhost",
+          table      => '*.*',
+          privileges => ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES'],
+          require    => Mysql_user["${backupuser}@localhost"],
+        }
+      }
+      else {
+        mysql_grant { "${backupuser}@localhost/*.*":
+          ensure     => $ensure,
+          user       => "${backupuser}@localhost",
+          table      => '*.*',
+          privileges => ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT'],
+          require    => Mysql_user["${backupuser}@localhost"],
+        }
+      }
+    }
   }
 
   if $install_cron {

spec/classes/mysql_backup_xtrabackup_spec.rb

@@ -11,7 +11,8 @@ class { 'mysql::server': }
         EOF
       end
       let(:facts) do
-        facts.merge(root_home: '/root')
+        facts.merge(root_home: '/root',
+                    mysql_version: '5.7')
       end
 
       let(:default_params) do
@@ -114,6 +115,67 @@ class { 'mysql::server': }
             )
             .that_requires('Mysql_user[backupuser@localhost]')
         end
+
+        context 'with MySQL version 5.7' do
+          let(:facts) do
+            facts.merge(mysql_version: '5.7')
+          end
+
+          it {
+            is_expected.not_to contain_mysql_grant('backupuser@localhost/performance_schema.keyring_component_status')
+            is_expected.not_to contain_mysql_grant('backupuser@localhost/performance_schema.log_status')
+            is_expected.not_to contain_mysql_grant('backupuser@localhost/*.*')
+              .with(
+                ensure: 'present',
+                user: 'backupuser@localhost',
+                table: '*.*',
+                privileges:
+                  ['BACKUP_ADMIN']
+              )
+              .that_requires('Mysql_user[backupuser@localhost]')
+          }
+        end
+
+        context 'with MySQL version 8.0' do
+          let(:facts) do
+            facts.merge(mysql_version: '8.0')
+          end
+
+          it {
+            is_expected.to contain_mysql_grant('backupuser@localhost/*.*')
+              .with(
+                ensure: 'present',
+                user: 'backupuser@localhost',
+                table: '*.*',
+                privileges:
+                if facts[:osfamily] == 'Debian' && Puppet::Util::Package.versioncmp(facts[:operatingsystemmajrelease], '11') == 0
+                  ['BINLOG MONITOR', 'RELOAD', 'PROCESS', 'LOCK TABLES', 'BACKUP_ADMIN']
+                else
+                  ['RELOAD', 'PROCESS', 'LOCK TABLES', 'REPLICATION CLIENT', 'BACKUP_ADMIN']
+                end,
+              )
+              .that_requires('Mysql_user[backupuser@localhost]')
+            is_expected.to contain_mysql_grant('backupuser@localhost/performance_schema.keyring_component_status')
+              .with(
+                ensure: 'present',
+                user: 'backupuser@localhost',
+                table: 'performance_schema.keyring_component_status',
+                privileges:
+                  ['SELECT']
+              )
+              .that_requires('Mysql_user[backupuser@localhost]')
+
+            is_expected.to contain_mysql_grant('backupuser@localhost/performance_schema.log_status')
+              .with(
+                ensure: 'present',
+                user: 'backupuser@localhost',
+                table: 'performance_schema.log_status',
+                privileges:
+                  ['SELECT']
+                )
+              .that_requires('Mysql_user[backupuser@localhost]')
+            }
+        end
       end
 
       context 'with additional cron args' do