Fix ssl verification always enabled for replication even if set to false (#707)

* Fix ssl verification always enabled for replication even if set to false * add changelog fragment * fix test when multiple replication channels are present * test: add check for changereplication * fix mismatch default value We use "None" as a default to know if the user provide this option or not. But a bool can't have a default of "None" for the sanity tests. So we must erase the line. * doc: add var name used by MySQL and MariaDB * Revert the change of default value * style * fix indentation * Revert "Revert the change of default value" This reverts commit db047fda90. * add changelog about changed default value * add link to issue and PR in changelog * doc: explain false had no effect prior to 3.14.0
2025-07-22 04:40:23 -07:00 · 2025-05-09 11:00:29 +02:00 · 2025-05-09 11:00:29 +02:00 · 49be739e89
commit 49be739e89
parent 7307a51f20
4 changed files with 86 additions and 7 deletions
--- a/tests/integration/targets/test_mysql_replication/tasks/issue-689.yml
+++ b/tests/integration/targets/test_mysql_replication/tasks/issue-689.yml
@ -0,0 +1,62 @@
+---
+
+- vars:
+    mysql_parameters: &mysql_params
+      login_user: '{{ mysql_user }}'
+      login_password: '{{ mysql_password }}'
+      login_host: '{{ mysql_host }}'
+      login_port: '{{ mysql_primary_port }}'
+  block:
+
+    - name: Disable ssl verification
+      community.mysql.mysql_replication:
+        <<: *mysql_params
+        login_port: '{{ mysql_replica1_port }}'
+        mode: changeprimary
+        primary_ssl_verify_server_cert: false
+      register: result
+
+    - name: Assert that changeprimmary is changed and return expected query for MariaDB and MySQL < 8.0.23
+      ansible.builtin.assert:
+        that:
+          - result is changed
+          - result.queries == expected_queries
+      when:
+        - >
+          db_engine == 'mariadb' or
+          (db_engine == 'mysql' and db_version is version('8.0.23', '<'))
+      vars:
+        expected_queries: ["CHANGE MASTER TO MASTER_SSL_VERIFY_SERVER_CERT=0"]
+
+    - name: Assert that changeprimmary is changed and return expected query for MySQL > 8.0.23
+      ansible.builtin.assert:
+        that:
+          - result is changed
+          - result.queries == expected_queries
+      when:
+        - db_engine == 'mysql'
+        - db_version is version('8.0.23', '>=')
+      vars:
+        expected_queries: ["CHANGE REPLICATION SOURCE TO SOURCE_SSL_VERIFY_SERVER_CERT=0"]
+
+    - name: Disable ssl verification for MySQL 8.0.23+
+      community.mysql.mysql_replication:
+        <<: *mysql_params
+        login_port: '{{ mysql_replica1_port }}'
+        mode: changereplication
+        primary_ssl_verify_server_cert: false
+      register: result
+      when:
+        - db_engine == 'mysql'
+        - db_version is version('8.0.23', '>=')
+
+    - name: Assert that changereplication is changed and return expected query for MySQL > 8.0.23
+      ansible.builtin.assert:
+        that:
+          - result is changed
+          - result.queries == expected_queries
+      when:
+        - db_engine == 'mysql'
+        - db_version is version('8.0.23', '>=')
+      vars:
+        expected_queries: ["CHANGE REPLICATION SOURCE TO SOURCE_SSL_VERIFY_SERVER_CERT=0"]
--- a/tests/integration/targets/test_mysql_replication/tasks/main.yml
+++ b/tests/integration/targets/test_mysql_replication/tasks/main.yml
@ -13,6 +13,10 @@
 # Tests of replication filters and force_context
 - include_tasks: issue-265.yml

+# primary_ssl_verify_server_cert
+# Must run before mysql add channels in mysql_replication_channel.yml
+- import_tasks: issue-689.yml
+
 # Tests of primary_delay parameter:
 - import_tasks: mysql_replication_primary_delay.yml