Support changes to root and sstuser passwords

[Cory Johns]

Per the comment at the top of percona_hooks.py, these config options should not be immutable, and immutable config goes against guidelines (https://jujucharms.com/docs/1.20/authors-charm-best-practice#juju-best-practices-and-tips-from-canonical's-infrastructure-team).

This came up during review of a fork of this charm for Galera Cluster (https://bugs.launchpad.net/charms/+bug/1430796), so perhaps a joint effort could get this issue resolved for both charms at once.

[Xiang Hui (xianghui)]

Before [1] is landed, we'll hold this bug.
After [1] landed, will take a look whether [2] could apply to percona-cluster in the same way.

[1] https://launchpad.net/bugs/1454317
[2] http://bazaar.launchpad.net/~codership/charms/trusty/galera-cluster/trunk/revision/57

[Janghoon-Paul Sim (janghoon)]

This bug also affects me.

Users may expects that "juju config percona-cluster root-password=$NEW_PASSWORD" command will change root password on mysql side as well.
However, it doesn't change it actually.
It would cause confusion and hooking errors for users.

Also, juju charm documentation[1] doesn't mention it clearly.
The documentation should mention about this limitation more clearly like this on configuration section.

Keep in mind that you have to change manually those passwords on mysql side as well if you update this password.

[1] https://jujucharms.com/percona-cluster/252

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/474032

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/488603

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/488603
Committed: https://git.openstack.org/cgit/openstack/charm-percona-cluster/commit/?id=62ed38b7b2affe163d7597abfd520abc9c7cdd30
Submitter: Jenkins
Branch: master

commit 62ed38b7b2affe163d7597abfd520abc9c7cdd30
Author: Felipe Reyes <email address hidden>
Date: Fri Jul 28 16:23:05 2017 -0400

    Resync charm-helpers for support to change passwords

    Change-Id: I1337096eb32250285e4a4a5d2b1975f91993816a
    Partial-Bug: 1436093

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/474032
Committed: https://git.openstack.org/cgit/openstack/charm-percona-cluster/commit/?id=e7f611ff2e01312a7ae88f8ed871dd7bf75b0e80
Submitter: Jenkins
Branch: master

commit e7f611ff2e01312a7ae88f8ed871dd7bf75b0e80
Author: Felipe Reyes <email address hidden>
Date: Tue Jun 13 22:42:18 2017 -0400

    Add support to change root password

    Change the configured root's password in percona and update the leader
    settings.

    Change-Id: I7168a96cac7a3b4df7fcfa1afc6f35076748578b
    Partial-Bug: 1436093

[Dmitrii Shcherbakov (dmitriis)]

There is still the sst part left which should touch the wsrep_sst_auth variable at runtime:

http://galeracluster.com/documentation-webpages/mysqlwsrepoptions.html
wsrep_sst_auth
Variable Scope: Global
Permitted Values Type: string
Valid Values: username:password

And also result in re-rendering of my.cnf/mysqld.cnf:

wsrep_sst_auth="sstuser:{{ sst_password }}"

~~

The source code has relevant update methods:

https://git.launchpad.net/~ubuntu-server-dev/ubuntu/+source/percona-xtradb-cluster-5.7/tree/sql/sys_vars.cc?h=ubuntu/bionic&id=debian/5.7.20-29.24-0ubuntu2.1#n6220
static Sys_var_charptr Sys_wsrep_sst_auth(
       "wsrep_sst_auth", "Authentication for SST connection",
       PREALLOCATED GLOBAL_VAR(wsrep_sst_auth), CMD_LINE(REQUIRED_ARG, OPT_WSREP_SST_AUTH),
       IN_FS_CHARSET, DEFAULT(wsrep_sst_auth), NO_MUTEX_GUARD,
       NOT_IN_BINLOG,
       ON_CHECK(wsrep_sst_auth_check),
       ON_UPDATE(wsrep_sst_auth_update));

https://git.launchpad.net/~ubuntu-server-dev/ubuntu/+source/percona-xtradb-cluster-5.7/tree/sql/wsrep_sst.cc?h=ubuntu/bionic&id=debian/5.7.20-29.24-0ubuntu2.1#n194
bool wsrep_sst_auth_update (sys_var *self, THD* thd, enum_var_type type)
{
    return sst_auth_real_set (wsrep_sst_auth);
}
https://git.launchpad.net/~ubuntu-server-dev/ubuntu/+source/percona-xtradb-cluster-5.7/tree/sql/wsrep_sst.cc?h=ubuntu/bionic&id=debian/5.7.20-29.24-0ubuntu2.1#n163
static bool sst_auth_real_set (const char* value)
// ..

And the variable is marked as dynamic in documentation:
https://www.percona.com/doc/percona-xtradb-cluster/5.5/wsrep-system-index.html#wsrep_sst_auth

[Dmitrii Shcherbakov (dmitriis)]

I validated on a single-unit deployment that currently (18.08) root password changes work but sst password changes do not. If sst-password is set via `juju run --unit mysql/0 'leader-set sst-password=newpasswd'` and a jujud-unit-mysql-0 unit is restarted (to trigger a config-changed event as the leader itself does not receive leader-settings-changed), the code gets to the pxc_installed check which prevents a new sst password from being set.

    133 def install_percona_xtradb_cluster():
    134 '''Attempt PXC install based on seeding of passwords for users'''
    135 if pxc_installed():
    136 log('MySQL already installed, skipping')
--> 137 return

So the change would be to augment this portion of config-changed hook implementation:

    # the password needs to be updated only if the node was already
    # bootstrapped
    if is_bootstrapped():
        update_root_password()
        # update_sst_password() <----
        set_ready_on_peers()