Conversation
…ser task Lets vars files opt a user into mysql_native_password (or other explicit auth plugins) instead of the server's default. Params default to omit, so existing entries without a plugin key are unaffected.
There was a problem hiding this comment.
Pull request overview
This PR updates the MySQL user creation playbook to allow callers to explicitly control which MySQL authentication plugin (and related auth strings) are used when creating users, rather than always inheriting the server default.
Changes:
- Exposes
plugin,plugin_hash_string, andplugin_auth_stringon themysql_usertask (defaulting toomit). - Enables vars files to force non-default auth plugins (e.g.,
mysql_native_password) for compatibility with clients that can’t usecaching_sha2_password.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
plugin: AWSAuthenticationPlugin previously slipped past the mysql_user task's guard (which only checked mysql_plugin), hit the module with an unsupported plugin value, and never reached the IAM-specific shell tasks. Both keys now route to the same path for that sentinel value.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
playbooks/create_db_and_users.yml:106
mysql_usernow supportsplugin, butmysql_pluginis still referenced in thewhenclause. If a vars entry setsmysql_pluginto a non-AWS value (e.g.mysql_native_password), the task will run but won’t actually pass that plugin tomysql_user, so the user will still be created with the server default plugin.
plugin: "{{ item.plugin | default(omit) }}"
plugin_hash_string: "{{ item.plugin_hash_string | default(omit) }}"
plugin_auth_string: "{{ item.plugin_auth_string | default(omit) }}"
when: (item.mysql_plugin | default('')) != 'AWSAuthenticationPlugin' and (item.plugin | default('')) != 'AWSAuthenticationPlugin'
nkhaleelulla-sonata-byte
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
create_db_and_users.yml'smysql_usertask didn't exposeplugin/plugin_hash_string/plugin_auth_string, so vars files had no way to force a specific auth plugin (e.g.mysql_native_password) on user creation — new users always got the server's default (caching_sha2_passwordon MySQL8).omitwhen not set on adatabase_usersentry, so this is a no-op for every existing entry.edx/edx-internal(addsopenflow001to prod enterprise-subsidy) is the first consumer — needed because NiFi/Openflow's JDBC driver can't complete the caching_sha2_password handshake.Test plan
pluginkey on any user — confirm no diff in behavior (idempotent, no changed auth)openflow001entry — confirm user created withmysql_native_password