MySQLGroupReplication集群对IP地址的限制导致的一些问题与解决

内容提要
●   1. 遇到问题

●   2. 问题排查

●   3. 问题解决

●   4. 问题的延伸

1. 遇到问题
测试人员小玲准备在docker环境中部署MGR集群进行一些测试，她有三个容器，容器IP分别是：

172.33.0.2
172.33.0.3
172.33.0.4

每个容器中分别安装一个MySQL实例，每个实例的group_replication_local_address和group_replication_group_seeds两个配置项分别是：

group_replication_local_address= "172.33.0.2:33061"
group_replication_group_seeds= "172.33.0.2:33061,172.33.0.3:33061,172.33.0.4:33061"

group_replication_local_address= "172.33.0.3:33061"
group_replication_group_seeds= "172.33.0.2:33061,172.33.0.3:33061,172.33.0.4:33061"

group_replication_local_address= "172.33.0.4:33061"
group_replication_group_seeds= "172.33.0.2:33061,172.33.0.3:33061,172.33.0.4:33061"

在经过了一番基础的准备操作之后，小玲在172.33.0.2上执行START GROUP_REPLICATION，结果遇到了不应该出现的错误信息：

mysql> START GROUP_REPLICATION;
ERROR 3092 (HY000): The server is not configured properly to be
an active member of the group. Please see more details on error log.

2. 问题排查
观察错误日志：

2021-07-13T03:11:42.645537Z 0 [Warning] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Connection attempt from IP address ::ffff:172.33.0.2 refused. Address is not in the IP allowlist.'
2021-07-13T03:11:42.645622Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Error connecting to the local group communication engine instance.'

根据错误日志中的信息，我们大概可以知道报错的直接原因是172.33.0.2这个IP不在白名单中。

这就有些奇怪了，因为默认情况下MySQL的相关配置选项是这样的：

mysql> show variables like "%group_replication_ip%";
+--------------------------------+-----------+
| Variable_name                  | Value     |
+--------------------------------+-----------+
| group_replication_ip_allowlist | AUTOMATIC |
| group_replication_ip_whitelist | AUTOMATIC |
+--------------------------------+-----------+
2 rows in set (0.00 sec)

参数 group_replication_ip_allowlist和 group_replication_ip_whitelist是同一个参数，只是由于美国的一些政治正确问题，white和black这样的单词都要从MySQL的代码中逐渐移除，不过本文中笔者依旧按照中文的习惯，称其为“白名单”。

这个参数是用来控制哪些host可以加入到当前这个MGR的group中，尽管你可以提前设置，但它只有在执行了START GROUP_REPLICATION且Group Communication System（GCS）变得可用时才会进行验证。默认情况下其值为AUTOMATIC，能够自动将localhost以及当前主机在各个私有子网中的IP地址添加到白名单中。

By default, this system variable is set to AUTOMATIC, which permits connections from private subnetworks active on the host. The group communication engine for Group Replication (XCom) automatically scans active interfaces on the host, and identifies those with addresses on private subnetworks. These addresses and the localhost IP address for IPv4 and (from MySQL 8.0.14) IPv6 are used to create the Group Replication allowlist.

根据这样的描述，172.33.0.2这个IP是应该在白名单中的，不应该出现上面遇到的报错信息。但在官方文档中，在上面这段话后面，紧跟着另一章节的连接，具体说明了一些限制。

根据Group Replication IP Address Permissions中的描述，MGR能够自动识别并添加到白名单的IP地址范围如下。

I

Pv4 (as defined in RFC 1918)
10/8 prefix       (10.0.0.0 - 10.255.255.255) - Class A
172.16/12 prefix  (172.16.0.0 - 172.31.255.255) - Class B
192.168/16 prefix (192.168.0.0 - 192.168.255.255) - Class C

IPv6 (as defined in RFC 4193 and RFC 5156)
fc00:/7 prefix    - unique-local addresses
fe80::/10 prefix  - link-local unicast addresses

127.0.0.1 - localhost for IPv4
::1       - localhost for IPv6

可见172.33.0.2恰好超出了Class B的范围，报错信息的确符合文档的描述，只是对用户的确不太友好，如果是第一次遇到会有些摸不到头脑。

3. 问题解决
每个节点执行：

set global group_replication_ip_allowlist="172.33.0.2,172.33.0.3,172.33.0.4";

选择一个节点执行：

SET GLOBAL group_replication_bootstrap_group=OFF;

START GROUP_REPLICATION;

其他节点执行：

START GROUP_REPLICATION;

执行结果如下：

mysql> START GROUP_REPLICATION;

Query OK, 0 rows affected (2.70 sec)

mysql>
mysql> SELECT * FROM performance_schema.replication_group_members;
+---------------------------+--------------------------------------+-------------+-------------+--------------+-------------+----------------+
| CHANNEL_NAME              | MEMBER_ID                            | MEMBER_HOST | MEMBER_PORT | MEMBER_STATE | MEMBER_ROLE | MEMBER_VERSION |
+---------------------------+--------------------------------------+-------------+-------------+--------------+-------------+----------------+
| group_replication_applier | 2a3d09a5-e386-11eb-8323-0242ac210003 | 172.33.0.3  |        3306 | ONLINE       | PRIMARY     | 8.0.25         |
| group_replication_applier | 58a2e9d0-e386-11eb-aff3-0242ac210002 | 172.33.0.2  |        3306 | ONLINE       | PRIMARY     | 8.0.25         |
| group_replication_applier | 5dbb146a-e386-11eb-8a06-0242ac210004 | 172.33.0.4  |        3306 | ONLINE       | PRIMARY     | 8.0.25         |
+---------------------------+--------------------------------------+-------------+-------------+--------------+-------------+----------------+
3 rows in set (0.00 sec)

4. 问题的延伸
group_replication_ip_allowlist这个参数是可以动态设置，并且会立刻生效，所以向一个MGR复制组中增加新的节点时，只需要加新节点的地址加入到这个参数中即可。

参考文章：

[1] group_replication_ip_allowlist（https://dev.mysql.com/doc/refman/8.0/en/group-replication-options.html#sysvar_group_replication_ip_allowlist）

[2] Group Replication IP Address Permissions（https://dev.mysql.com/doc/refman/8.0/en/group-replication-ip-address-permissions.html）