Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

system variable: add tidb_restricted_read_only #7670

Merged
merged 5 commits into from
Apr 26, 2022
Merged

system variable: add tidb_restricted_read_only #7670

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b7a4d0e
system variable: add `tidb_restricted_read_only`
en-jin19 Feb 22, 2022
f109d26
Apply suggestions from code review
en-jin19 Mar 4, 2022
aca60e5
Apply suggestions from code review
en-jin19 Apr 14, 2022
3249263
Apply suggestions from code review
en-jin19 Apr 15, 2022
710f380
Revise the order of the configuration item
en-jin19 Apr 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions privilege-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,7 @@ Dynamic privileges include:
* `ROLE_ADMIN`
* `CONNECTION_ADMIN`
* `SYSTEM_VARIABLES_ADMIN`
* `RESTRICTED_REPLICA_WRITER_ADMIN` allows privilege owners to perform write or update operations without being affected when the TiDB cluster is enabled the read-only mode. For details, see [`tidb_restricted_read_only`](/system-variables.md#tidb_restricted_read_only-new-in-v520).

To see the full set of dynamic privileges, execute the `SHOW PRIVILEGES` statement. Because plugins are permitted to add new privileges, the list of privileges that are assignable might differ based on your TiDB installation.

Expand Down
15 changes: 15 additions & 0 deletions system-variables.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -754,6 +754,21 @@ Constraint checking is always performed in place for pessimistic transactions (d
- `RESTRICTED_VARIABLES_ADMIN`: The ability to see and set sensitive variables in `SHOW [GLOBAL] VARIABLES` and `SET`.
- `RESTRICTED_USER_ADMIN`: The ability to prevent other users from making changes or dropping a user account.

### tidb_restricted_read_only <span class="version-mark">New in v5.2.0</span>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

建议按字母顺序放在下方


- Scope: GLOBAL
- Default value: `0`
- Optional values: `0`, `1`
- This variable controls the read-only status of the entire cluster. If the variable is enabled (the value is `1`), all TiDB servers in the entire cluster turn on the read-only mode. In this case, TiDB only execute the statements that do not modify data, such as `SELECT`, `USE`, `SHOW`. For others, such as `INSERT`, `UPDATE`, TiDB rejects to execute those statements in the read-only mode.
- The read-only mode enabled by this variable only ensures that the entire cluster finally goes into the read-only status. If you have changed the value of this variable, but the changed status is not updated to other TiDB servers, the un-updated TiDB is still **not** in the read-only mode.
- During enabling this variable, the executing SQL statements are not affected. TiDB only checks the read-only status for the SQL statements to be executed.
- During enabling this variable, the uncommitted transactions can have the following results:
- If there is an uncommitted read-only transaction, the transaction can be committed normally.
- If the uncommitted transaction is not a read-only transaction, the SQL statements executing write operations in the transaction are rejected.
- If the uncommitted read-only transaction has modified data, the commitment of the transaction is rejected.
- After the read-only mode is enabled, unless the user is explicitly granted the `RESTRICTED_REPLICA_WRITER_ADMIN` privileges, all users (including the users with the `SUPER` privilege) cannot execute the SQL statements that might write data.
- The users with `RESTRICTED_VARIABLES_ADMIN` or `SUPER` privileges can modify this variable. However, if the [Security Enhanced Mode](#tidb_enable_enhanced_security) is enabled, only the users with the `RESTRICTED_VARIABLES_ADMIN` privilege can modify this variable.

### tidb_enable_fast_analyze

> **Warning:**
Expand Down