Deploy a Heterogeneous Cluster for an Existing TiDB Cluster

To enable TLS for a heterogeneous cluster, you need to explicitly declare the TLS configuration, issue the certificates using the same certification authority (CA) as the target cluster and create new secrets with the certificates.

If you want to issue the certificate using cert-manager, choose the same Issuer as that of the target cluster to create your Certificate.

For detailed procedures to create certificates for the heterogeneous cluster, refer to the following two documents:

• Enable TLS between TiDB Components
• Enable TLS for the MySQL Client

After creating certificates, take the following steps to deploy a TLS-enabled heterogeneous cluster.

1. Create a cluster configuration file for the heterogeneous cluster.

   For example, save the following configuration as the cluster.yaml file. Replace ${heterogeneous_cluster_name} with the desired name of your heterogeneous cluster, and replace ${origin_cluster_name} with the name of the existing cluster.

   Note

   Comparing with the configuration file of a normal TiDB cluster, the only difference in the configuration file of a heterogeneous TiDB cluster is that you need to additionally specify the spec.cluster.name field as the name of an existing TiDB cluster. According to this field, TiDB Operator adds the heterogeneous cluster to the existing TiDB cluster.

   apiVersion: pingcap.com/v1alpha1
   kind: TidbCluster
   metadata:
     name: ${heterogeneous_cluster_name}
   spec:
     tlsCluster:
       enabled: true
     configUpdateStrategy: RollingUpdate
     version: v8.5.2
     timezone: UTC
     pvReclaimPolicy: Delete
     discovery: {}
     cluster:
       name: ${origin_cluster_name}
     tikv:
       baseImage: pingcap/tikv
       maxFailoverCount: 0
       replicas: 1
       # If storageClassName is not set, the default Storage Class of the Kubernetes cluster is used.
       # storageClassName: local-storage
       requests:
         storage: "100Gi"
       config: {}
     tidb:
       baseImage: pingcap/tidb
       maxFailoverCount: 0
       replicas: 1
       service:
         type: ClusterIP
       config: {}
       tlsClient:
         enabled: true
     tiflash:
       baseImage: pingcap/tiflash
       maxFailoverCount: 0
       replicas: 1
       storageClaims:
         - resources:
             requests:
               storage: 100Gi
   

   In the configuration file, spec.tlsCluster.enabledcontrols whether to enable TLS between the components and spec.tidb.tlsClient.enabledcontrols whether to enable TLS for the MySQL client.

   • For more configurations of a TLS-enabled heterogeneous cluster, see the 'heterogeneous-tls' example.
   • For more configurations and field meanings of a TiDB cluster, see the TiDB cluster configuration document.

2. In the configuration file of your heterogeneous cluster, modify the configurations of each node according to your need.

   For example, you can modify the number of replicas for each component in the cluster.yaml file, or remove components that are not needed.

3. Create the TLS-enabled heterogeneous cluster by running the following command. You need to replace cluster.yaml with the configuration filename of the heterogeneous cluster.

   kubectl create -f cluster.yaml -n ${namespace}
   

   If the output shows tidbcluster.pingcap.com/${heterogeneous_cluster_name} created, the execution is successful. Then, TiDB Operator will create the TiDB cluster with the configurations according to your cluster configuration file.